Regular Expression Denial of Service in sqlparse Package - CVE-2021-32839
Summary
UBUNTU-CVE-2021-32839: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse versions < 0.4.1-1ubuntu1. Fixed in 0.4.1-1ubuntu1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python, widely used for parsing SQL statements and formatting them. It provides functionalities to manipulate SQL queries, making it easier for developers to work with SQL in Python applications. However, certain versions of sqlparse are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can lead to performance degradation when processing specific SQL comments.
Vulnerability Detail
The vulnerability identified as CVE-2021-32839 affects sqlparse versions 0.4.0 and 0.4.1. It arises from a regular expression that may cause exponential backtracking when processing strings containing many repetitions of '\r\n' in SQL comments. This can lead to significant delays or crashes in applications that rely on the formatting feature of sqlparse, particularly when the 'strip_comments' option is enabled. The impact of this vulnerability is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.4.1-1ubuntu1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlparseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'sqlformat.format' function with the 'strip_comments=True' option or refrain from using the '--strip-comments' command line flag when utilizing the sqlformat command line tool.
Conclusion
CVE-2021-32839 is a significant vulnerability in the sqlparse package that can lead to performance issues in applications. Users are strongly advised to update to the patched version 0.4.2 or later to mitigate the risks associated with this vulnerability. In the meantime, workarounds are available to reduce exposure.
See every vulnerability recorded for sqlparse →
FAQ
CVE-2021-32839 is a vulnerability in the sqlparse package that allows for a Regular Expression Denial of Service (ReDoS) attack, affecting the performance of applications using this package.
The vulnerability affects sqlparse versions 0.4.0 and 0.4.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, you can use the provided workaround to mitigate the risk by avoiding the use of the 'strip_comments' option.
The CVSS score of CVE-2021-32839 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
