Denial of Service Vulnerability in sqlparse: RecursionError from Nested Lists
Summary
CVE-2024-4340: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. Affects sqlparse across 2 version ranges.
< 0.4.1-1+deb11u1
< b4a39d9850969b4e1d6940d32094ee0b42a2cf03
Fixed in 0.4.1-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser for Python that provides support for parsing, splitting, and formatting SQL statements. It is widely used in applications that require SQL query manipulation. However, the package is vulnerable to a Denial of Service (DoS) attack when it processes heavily nested lists, which can lead to a RecursionError, causing the application to crash or become unresponsive.
Vulnerability Detail
The vulnerability arises when sqlparse.parse() is provided with a deeply nested list structure. This can trigger excessive recursion, leading to a RecursionError. The potential ramifications include application downtime and denial of service to users, as the application may become unresponsive or crash entirely. This issue affects all versions of sqlparse prior to the fix, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
0.4.1-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlparseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing heavily nested lists to the sqlparse.parse() function. Instead, ensure that the input is simplified and does not exceed reasonable nesting levels. This will help prevent the RecursionError until the package can be updated.
Conclusion
The sqlparse package has a critical vulnerability that can lead to Denial of Service due to excessive recursion when processing nested lists. It is essential for users to update to the latest version to mitigate this risk. Temporary workarounds can help until an update is applied.
See every vulnerability recorded for sqlparse →
FAQ
The vulnerability is a Denial of Service (DoS) issue caused by passing deeply nested lists to the sqlparse.parse() function, leading to a RecursionError.
All versions of sqlparse prior to version 0.5.0-1 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without requiring code access.
If an immediate update is not possible, avoid using deeply nested lists with the sqlparse.parse() function as a temporary workaround.
More information can be found in the CVE details and the official sqlparse repository on GitHub.
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
