Exponential Backtracking Vulnerability in sqlparse Package
Summary
CVE-2021-32839: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse across 2 version ranges.
< 0.4.1-1+deb11u1
< 8238a9e450ed1524e40cb3a8b0b3c00606903aeb
Fixed in 0.4.1-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python, widely used for parsing SQL statements. It provides functionality to format SQL queries, making them more readable and easier to manage. However, certain versions of sqlparse are susceptible to a vulnerability that can lead to performance degradation under specific conditions.
Vulnerability Detail
In sqlparse versions 0.4.0 and 0.4.1, a regular expression vulnerability exists that can cause exponential backtracking when processing strings with numerous repetitions of '\r\n' in SQL comments. This vulnerability primarily affects the formatting feature that removes comments from SQL statements. If exploited, it can lead to Denial of Service (DoS) by consuming excessive CPU resources, potentially impacting application performance and availability.
How To Fix
Minimum fixed version
0.4.1-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlparseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the sqlformat.format function with the keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. This will prevent the vulnerability from being triggered while you work on upgrading the package.
Conclusion
The sqlparse package has a vulnerability that can lead to performance issues due to exponential backtracking in specific versions. Users are advised to upgrade to the latest version to mitigate this risk. Temporary workarounds are available, but upgrading is the recommended solution.
See every vulnerability recorded for sqlparse →
FAQ
sqlparse versions 0.4.0 and 0.4.1 are affected by this vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Exploitation of this vulnerability can lead to Denial of Service (DoS), causing significant performance issues and potentially making the application unavailable.
Yes, the permanent fix is to upgrade sqlparse to version 0.4.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
