Lucene search

Regular Expression Denial Of Service (ReDoS)

🗓️ 24 Apr 2023 11:24:07Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 23 Views

SQLparse vulnerability to ReDoS attack due to inefficient regex in lexer.py

Reporter	Title	Published	Views	Family All 40
Tenable Nessus	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : SQL parse vulnerability (USN-6064-1)	13 May 202300:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-sqlparse (SUSE-SU-2023:2619-1)	26 Jun 202300:00	–	nessus
Tenable Nessus	SUSE SLES15 : Recommended update for google-cloud SDK (SUSE-SU-SUSE-RU-2024:1637-3)	14 Sep 202400:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for google-cloud SDK (SUSE-SU-SUSE-RU-2024:1637-1)	15 May 202400:00	–	nessus
Tenable Nessus	Debian DLA-3425-1 : sqlparse - LTS security update	17 May 202300:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for google-cloud SDK (SUSE-SU-SUSE-RU-2024:1637-2)	21 Jun 202400:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 Security Update : python-sqlparse (SUSE-SU-2023:2462-1)	9 Jun 202300:00	–	nessus
Tenable Nessus	RHEL 8 : RHUI 4.5.0 - Security, Bug Fixes, and Enhancements (Moderate) (RHSA-2023:4591)	28 Apr 202400:00	–	nessus
Tenable Nessus	Rocky Linux 8 : Satellite 6.14 (RLSA-2023:6818)	11 Nov 202300:00	–	nessus
Tenable Nessus	RHEL 8 : Satellite 6.14 (RHSA-2023:6818)	29 Apr 202400:00	–	nessus

Vulners

Node

sqlparse_project sqlparseMatch0.4.2_3.el8pcpython

sqlparse_project sqlparseMatch0.4.1_1.el8pcpython

sqlparse_project sqlparseMatch0.4.1_4.el8pcpython

sqlparse_project sqlparseMatch0.4.2_4.1.1.el8uipython

sqlparse_project sqlparseMatch0.4.2_4.el8uipython

sqlparse_project sqlparseMatch0.2.4_6.epel8.playgroundpython

sqlparse_project sqlparseMatch0.2.4_10.el8python

sqlparse_project sqlparseMatch0.2.2_6.1.el8ostpython

sqlparse_project sqlparseMatch0.4.1_1.el8uipython

sqlparse_project sqlparseMatch0.2.4_6.el8python

sqlparse_project sqlparseMatch0.4.1_1.el8ost.1python

sqlparse_project sqlparseMatch0.4.2_2.el8pcpython

sqlparse_project sqlparseMatch0.2.2_6.2.el8ostpython

sqlparseRange≤0.4.3

Source	Link
github	www.github.com/andialbrecht/sqlparse/blob/e75e35869473832a1eb67772b1adfee2db11b85a/sqlparse/lexer.py
github	www.github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
github	www.github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
github	www.github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a
lists	www.lists.debian.org/debian-lts-announce/2023/05/msg00017.html
owasp	www.owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

24 Apr 2023 11:07Current

7.1High risk

Vulners AI Score7.1

EPSS0.001