CVE Vulnerabilities

CVE-2024-4340

Uncontrolled Recursion

Published: Apr 30, 2024 | Modified: Apr 30, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Name Vendor Start Version End Version
Red Hat Ansible Automation Platform 2.4 for RHEL 8 RedHat python3x-sqlparse-0:0.5.0-1.el8ap *
Red Hat Ansible Automation Platform 2.4 for RHEL 9 RedHat python-sqlparse-0:0.5.0-1.el9ap *
Sqlparse Ubuntu devel *
Sqlparse Ubuntu jammy *
Sqlparse Ubuntu mantic *
Sqlparse Ubuntu noble *
Sqlparse Ubuntu upstream *

Potential Mitigations

References