Bug 1190741 (CVE-2021-32839)

Summary: VUL-0: CVE-2021-32839: python-sqlparse: ReDoS via regular expression in StripComments filter
Product: [Novell Products] SUSE Security Incidents Reporter: Gabriele Sonnu <gabriele.sonnu>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: IN_PROGRESS --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/310438/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-32839:6.5:(AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Gabriele Sonnu 2021-09-21 15:44:19 UTC
The formatter function that strips comments from a SQL contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments.

Reference:
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2005072
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32839
https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf
Comment 1 Gabriele Sonnu 2021-09-21 15:45:04 UTC
Affected packages:

 - SUSE:SLE-15-SP3:Update/python-sqlparse                         0.4.1
 - openSUSE:Factory/python-sqlparse                               0.4.1

Upstream patch:

https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
Comment 2 Johannes Grassler 2021-10-01 12:49:15 UTC
Updated package for openSUSE submitted: https://build.opensuse.org/request/show/922560

Will submit against SLE 15 SP3 once this hits Factory.
Comment 3 Johannes Grassler 2021-10-04 09:04:49 UTC
Matej created a request for Factory: https://build.opensuse.org/request/show/922565
Comment 4 Johannes Grassler 2021-11-10 10:51:00 UTC
Request for SLE 15 SP3 created: https://build.suse.de/request/show/258106
Comment 5 Swamp Workflow Management 2021-12-01 21:03:17 UTC
SUSE-SU-2021:3857-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1190741
CVE References: CVE-2021-32839
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python-sqlparse-0.4.2-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2021-12-01 21:27:59 UTC
openSUSE-SU-2021:3857-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1190741
CVE References: CVE-2021-32839
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    python-sqlparse-0.4.2-3.3.1
Comment 7 Christian Almeida de Oliveira 2022-01-10 08:48:15 UTC
Update for SLE 15 SP3 available, back to Security team.