CVE-2024-4340: sqlparse parsing heavily nested list leads to Denial of Service
(updated )
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
References
- github.com/advisories/GHSA-2m57-hf25-phgg
- github.com/andialbrecht/sqlparse
- github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
- github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg
- nvd.nist.gov/vuln/detail/CVE-2024-4340
- research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292
Code Behaviors & Features
Detect and mitigate CVE-2024-4340 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →