Bug 1190741 - (CVE-2021-32839) VUL-0: CVE-2021-32839: python-sqlparse: ReDoS via regular expression in StripComments filter
(CVE-2021-32839)
VUL-0: CVE-2021-32839: python-sqlparse: ReDoS via regular expression in Strip...
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/310438/
CVSSv3.1:SUSE:CVE-2021-32839:6.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-09-21 15:44 UTC by Gabriele Sonnu
Modified: 2022-01-10 08:48 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gabriele Sonnu 2021-09-21 15:44:19 UTC
The formatter function that strips comments from a SQL contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments.

Reference:
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2005072
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32839
https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf
Comment 1 Gabriele Sonnu 2021-09-21 15:45:04 UTC
Affected packages:

 - SUSE:SLE-15-SP3:Update/python-sqlparse                         0.4.1
 - openSUSE:Factory/python-sqlparse                               0.4.1

Upstream patch:

https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
Comment 2 Johannes Grassler 2021-10-01 12:49:15 UTC
Updated package for openSUSE submitted: https://build.opensuse.org/request/show/922560

Will submit against SLE 15 SP3 once this hits Factory.
Comment 3 Johannes Grassler 2021-10-04 09:04:49 UTC
Matej created a request for Factory: https://build.opensuse.org/request/show/922565
Comment 4 Johannes Grassler 2021-11-10 10:51:00 UTC
Request for SLE 15 SP3 created: https://build.suse.de/request/show/258106
Comment 5 Swamp Workflow Management 2021-12-01 21:03:17 UTC
SUSE-SU-2021:3857-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1190741
CVE References: CVE-2021-32839
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python-sqlparse-0.4.2-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2021-12-01 21:27:59 UTC
openSUSE-SU-2021:3857-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1190741
CVE References: CVE-2021-32839
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    python-sqlparse-0.4.2-3.3.1
Comment 7 Christian Almeida de Oliveira 2022-01-10 08:48:15 UTC
Update for SLE 15 SP3 available, back to Security team.