sqlparse parsing heavily nested list leads to Denial of Service

🗓️ 15 Apr 2024 20:21:25Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 49 Views

sqlparse.parse() Denial of Service due to nested list recursion

Reporter	Title	Published	Views	Family All 76
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to sqlparse-0.4.4-py3-none-any.whl CVE-2024-4340	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in sqlparse affects IBM Process Mining CVE-2024-4340	28 Jun 202415:17	–	ibm
IBM Security Bulletins	Security Bulletin: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.	27 Sep 202503:16	–	ibm
IBM Security Bulletins	Security Bulletin: sqlparse Vulnerability Affects IBM Data Observability by Databand Self-Hosted (CVE-2024-4340)	28 Jan 202522:08	–	ibm
Chainguard	CVE-2024-4340 vulnerabilities	30 Apr 202415:15	–	cgr
Circl	CVE-2024-4340	15 Apr 202420:21	–	circl
CNNVD	sqlparse 安全漏洞	30 Apr 202400:00	–	cnnvd
CVE	CVE-2024-4340	30 Apr 202414:23	–	cve
Cvelist	CVE-2024-4340 Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.	30 Apr 202414:23	–	cvelist
Debian	[SECURITY] [DLA 4000-1] sqlparse security update	21 Dec 202418:44	–	debian

Vulners

Node

sqlparse_project sqlparseRange<0.5.0pip

Source	Link
github	www.github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg
github	www.github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-4340
research	www.research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292
github	www.github.com/advisories/GHSA-2m57-hf25-phgg

01 May 2024 11:09Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.10881

SSVC

sqlparse maximum recursion sqlparseerror impact fix suggestion user input