CVE-2023-30608: sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service
(updated )
The SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The vulnerability may lead to Denial of Service (DoS).
References
- github.com/advisories/GHSA-rrm6-wvj7-cwh2
- github.com/andialbrecht/sqlparse
- github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
- github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a
- github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
- github.com/pypa/advisory-database/tree/main/vulns/sqlparse/PYSEC-2023-87.yaml
- lists.debian.org/debian-lts-announce/2023/05/msg00017.html
- nvd.nist.gov/vuln/detail/CVE-2023-30608
- owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
Code Behaviors & Features
Detect and mitigate CVE-2023-30608 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →