Exponential Backtracking Vulnerability in sqlparse Package
Summary
DEBIAN-CVE-2021-32839: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse versions < 0.4.1-1+deb11u1. Fixed in 0.4.1-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python, designed to parse SQL statements and format them for readability. It is widely used in various applications that require SQL parsing capabilities. The package offers features such as formatting SQL queries, stripping comments, and more. However, certain versions of sqlparse are vulnerable to a specific issue that can lead to performance degradation under certain conditions.
Vulnerability Detail
In sqlparse versions 0.4.0 and 0.4.1, a vulnerability exists that allows for a Regular Expression Denial of Service (ReDoS). This vulnerability arises from a regular expression that may cause exponential backtracking when processing strings with numerous repetitions of '\r\n' in SQL comments. The impact of this vulnerability can lead to significant performance issues, as the formatting feature that removes comments from SQL statements becomes inefficient, potentially causing applications to hang or crash.
How To Fix
Minimum fixed version
0.4.1-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlparseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the sqlformat.format function with the keyword strip_comments=True or refrain from using the --strip-comments command line flag when utilizing the sqlformat command line tool. This will prevent the regular expression from being triggered and mitigate the risk of performance issues.
Conclusion
The sqlparse package has a vulnerability that can lead to performance issues due to a Regular Expression Denial of Service. It is crucial to update to the patched versions to mitigate risks. Users should also consider the provided workaround until they can apply the update.
See every vulnerability recorded for sqlparse →
FAQ
The vulnerability affects sqlparse versions 0.4.0 and 0.4.1.
It is a Regular Expression Denial of Service (ReDoS) vulnerability that can cause performance issues due to exponential backtracking.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You can implement the provided workaround by avoiding the use of the strip_comments feature in the sqlformat tool.
You can visit the official sqlparse documentation or its repository on platforms like GitHub for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
