PT-2023-3225 · Pypi +6 · Sqlparse +6

🗓️ 18 Apr 2023 00:00:00Reported by Positive TechnologiesType

sqlparse versions before 0.4.4 are vulnerable to Denial of Service via a regex; upgrade to 0.4.4 or restrict use.

Reporter	Title	Published	Views	Family All 178
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to sqlparse-0.4.4-py3-none-any.whl CVE-2024-4340	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in sqlparse affects IBM Process Mining CVE-2024-4340	28 Jun 202415:17	–	ibm
IBM Security Bulletins	Security Bulletin: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.	27 Sep 202503:16	–	ibm
IBM Security Bulletins	Security Bulletin: sqlparse Vulnerability Affects IBM Data Observability by Databand Self-Hosted (CVE-2024-4340)	28 Jan 202522:08	–	ibm
AlpineLinux	CVE-2021-32839	20 Sep 202117:10	–	alpinelinux
AlpineLinux	CVE-2023-30608	18 Apr 202322:15	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в sqlparse	3 May 202623:59	–	astralinux
Chainguard	CVE-2024-4340 vulnerabilities	30 Apr 202415:15	–	cgr
Circl	CVE-2021-32839	20 Sep 202120:26	–	circl
Circl	CVE-2024-4340	15 Apr 202420:21	–	circl

Source	Link
github	www.github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
github	www.github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a
github	www.github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
osv	www.osv.dev/vulnerability/USN-6064-1
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2023-30608
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
osv	www.osv.dev/vulnerability/GHSA-rrm6-wvj7-cwh2
errata	www.errata.rockylinux.org/RLSA-2023:6818
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

21 Dec 2024 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 25 - 7.8

CVSS 3.17.5

EPSS0.10881

SSVC