Most recent entries from all

CVE-2023-30608 — Parser contains an inefficient regular expression in sqlparse

Affected: andialbrecht sqlparse

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

GHSA-rrm6-wvj7-cwh2 — sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service

Affected: PyPI: sqlparse

### Impact The SQL parser contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service). The vulnerability may lead to Denial of Service (DoS).

### Patches This issues has been fixed in sqlparse 0.4.4.

### Workarounds None.

### References This issue was discovered and reported by GHSL team member [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh). - Commit that introduced the vulnerability: e75e35869473832a1eb67772b1adfee2db11b85a

PYSEC-2023-87

Affected: PyPI: sqlparse