Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
Weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | RedHat | python3x-sqlparse-0:0.5.0-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | RedHat | python-sqlparse-0:0.5.0-1.el9ap | * |
| Red Hat OpenStack Platform 17.1 for RHEL 8 | RedHat | python-sqlparse-0:0.4.1-2.el8ost | * |
| Red Hat OpenStack Platform 17.1 for RHEL 9 | RedHat | python-sqlparse-0:0.4.1-2.el9ost | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | python-sqlparse-0:0.5.0-1.el8pc | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | python-sqlparse-0:0.5.0-1.el8pc | * |
| RHUI 4 for RHEL 8 | RedHat | python-sqlparse-0:0.5.0-1.el8ui | * |
| Sqlparse | Ubuntu | devel | * |
| Sqlparse | Ubuntu | jammy | * |
| Sqlparse | Ubuntu | mantic | * |
| Sqlparse | Ubuntu | noble | * |
| Sqlparse | Ubuntu | upstream | * |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/advisories/GHSA-2m57-hf25-phgg
- https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
- https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/
- https://github.com/advisories/GHSA-2m57-hf25-phgg
- https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
- https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html
- https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/