SB2024051329 - Multiple vulnerabilities in Sqlparse

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2024-4340)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an uncontrolled recursion when processing a heavily nested list in sqlparse.parse(). A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the sql parsing logic when processing heavily nested lists. A remote attacker can supply specially crafted input to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/
• https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
• https://github.com/advisories/GHSA-2m57-hf25-phgg
• https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg