Bugzilla – Bug 1190741
VUL-0: CVE-2021-32839: python-sqlparse: ReDoS via regular expression in StripComments filter
Last modified: 2022-01-10 08:48:15 UTC
The formatter function that strips comments from a SQL contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Reference: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf References: https://bugzilla.redhat.com/show_bug.cgi?id=2005072 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32839 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32839 https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf
Affected packages: - SUSE:SLE-15-SP3:Update/python-sqlparse 0.4.1 - openSUSE:Factory/python-sqlparse 0.4.1 Upstream patch: https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
Updated package for openSUSE submitted: https://build.opensuse.org/request/show/922560 Will submit against SLE 15 SP3 once this hits Factory.
Matej created a request for Factory: https://build.opensuse.org/request/show/922565
Request for SLE 15 SP3 created: https://build.suse.de/request/show/258106
SUSE-SU-2021:3857-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1190741 CVE References: CVE-2021-32839 JIRA References: Sources used: SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): python-sqlparse-0.4.2-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:3857-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1190741 CVE References: CVE-2021-32839 JIRA References: Sources used: openSUSE Leap 15.3 (src): python-sqlparse-0.4.2-3.3.1
Update for SLE 15 SP3 available, back to Security team.