CVE-2023-30608

Description

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

How to fix CVE-2023-30608

To remediate CVE-2023-30608, upgrade the affected package to a fixed version below.

• —upgrade to 0.4.1-1+deb11u1 or later
• —upgrade to 0.2.4-1+deb10u1 or later
• —upgrade to 0.4.4 or later
• —upgrade to c457abd5f097dd13fb21543381e7cfafe7d31cfb or later

Is CVE-2023-30608 being exploited?

Low — EPSS is 1.3%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 0.4.1-1+deb11u1
• from 0, < 0.2.4-1+deb10u1
• >= 0.1.15, < 0.4.4
• from 0, < c457abd5f097dd13fb21543381e7cfafe7d31cfb, < e75e35869473832a1eb67772b1adfee2db11b85a | >= 0.1.15, < 0.4.4

CVSS scores

References (10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-30608
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-30608
• PATCHgithub.com/andialbrecht/sqlparse
• WEBgithub.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb