CVE-2021-32839

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-32839
sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb Patch Third Party Advisory
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:*
History

29 Sep 2021, 15:04

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.5 		v2 : 5.0
v3 : 7.5
References (CONFIRM) https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf - (CONFIRM) https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf - Third Party Advisory
References (MISC) https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb - (MISC) https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb - Patch, Third Party Advisory
CPE cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:*

20 Sep 2021, 18:15

Type Values Removed Values Added
CWE CWE-400
Summary sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2. sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.

20 Sep 2021, 17:21

Type Values Removed Values Added
New CVE
Information

Published : 2021-09-20 17:15

Updated : 2024-02-04 22:08

NVD link : CVE-2021-32839

Mitre link : CVE-2021-32839

CVE.ORG link : CVE-2021-32839

JSON object : View

Products Affected

sqlparse_project

  • sqlparse
CWE
CWE-400

Uncontrolled Resource Consumption