CVE-2024-4340

2024-04-3000:00:00

ubuntu.com

cve-2024-4340

denial of service

sqlparse.parse

recursionerror

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.6%

JSON

Passing a heavily nested list to sqlparse.parse() leads to a Denial of
Service due to RecursionError.

Bugs

<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070148>

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchsqlparse< 0.4.2-1ubuntu0.22.04.2UNKNOWN
ubuntu23.10noarchsqlparse< 0.4.2-1ubuntu1.1UNKNOWN
ubuntu24.04noarchsqlparse< 0.4.4-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	sqlparse	< 0.4.2-1ubuntu0.22.04.2	UNKNOWN
ubuntu	23.10	noarch	sqlparse	< 0.4.2-1ubuntu1.1	UNKNOWN
ubuntu	24.04	noarch	sqlparse	< 0.4.4-1ubuntu0.1	UNKNOWN