sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | python3.12-sqlparse-0:0.6.0-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | python3.12-sqlparse-0:0.6.0-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | RedHat | python-sqlparse-0:0.6.0-1.el10ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | python3.12-sqlparse-0:0.6.0-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.7 for RHEL 10 | RedHat | python-sqlparse-0:0.6.0-1.el10ap | * |
| Red Hat Ansible Automation Platform 2.7 for RHEL 9 | RedHat | python3.12-sqlparse-0:0.6.0-1.el9ap | * |
| Red Hat Satellite 6.16 for RHEL 8 | RedHat | python-sqlparse-0:0.6.0-1.el8pc | * |
| Red Hat Satellite 6.16 for RHEL 8 | RedHat | python-sqlparse-0:0.6.0-1.el8pc | * |
| Red Hat Satellite 6.16 for RHEL 9 | RedHat | python-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Satellite 6.16 for RHEL 9 | RedHat | python-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Satellite 6.17 for RHEL 9 | RedHat | python-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Satellite 6.17 for RHEL 9 | RedHat | python-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Satellite 6.18 for RHEL 9 | RedHat | python3.12-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Satellite 6.18 for RHEL 9 | RedHat | python3.12-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Satellite 6.19 for RHEL 9 | RedHat | python3.12-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Satellite 6.19 for RHEL 9 | RedHat | python3.12-sqlparse-0:0.6.0-1.el9pc | * |
| Red Hat Ansible Automation Platform 2.2 | RedHat | ansible-automation-platform/bootc-automation-portal-rhel9:1791865660 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/controller-rhel8:1789607021 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/gateway-rhel8:1789605572 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/hub-rhel8:1789606395 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/lightspeed-rhel8:1789685837 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/controller-rhel9:1789673739 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/eda-controller-rhel9:1789653608 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/gateway-rhel9:1789666472 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/hub-rhel9:1789611274 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/lightspeed-rhel9:1789656884 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-tech-preview/metrics-service-rhel9:1789654558 | * |
| Red Hat Ansible Automation Platform 2.7 | RedHat | ansible-automation-platform-27/eda-controller-rhel9:1788917355 | * |
| Red Hat Ansible Automation Platform 2.7 | RedHat | ansible-automation-platform-27/lightspeed-rhel9:1788916677 | * |
| Red Hat Ansible Automation Platform 2.7 | RedHat | ansible-automation-platform-27/metrics-service-rhel9:1788917058 | * |
| Red Hat Ansible Automation Platform 2.7 | RedHat | ansible-automation-platform-27/hub-rhel9:1789572632 | * |
| Red Hat Ansible Automation Platform 2.7 | RedHat | ansible-automation-platform-27/controller-rhel9:1791253059 | * |
| Red Hat Discovery 2 | RedHat | discovery/discovery-server-rhel9:1788205779 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-mlflow-rhel9:1791865967 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1791829804 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1791829182 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1791829658 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1791868244 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1791828837 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1791868241 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-cpu-torch210-py312-rhel9:1791874335 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-cuda130-torch210-py312-rhel9:1791961113 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-rocm64-torch291-py312-rhel9:1791872119 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-training-cuda128-torch29-py312-rhel9:1791786619 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1791788267 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1791872084 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1791829615 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1791832538 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1791868194 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1791833225 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1791868238 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1791829530 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-training-cuda128-torch29-py312-rhel9:1789529851 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-mlflow-rhel9:1791947857 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1791952873 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1791816462 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1791816487 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1791951049 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1791951047 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1791950760 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-th-torch-cpu-py312-rhel9:1791926611 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-th-torch-cuda-py312-rhel9:1791927642 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-th-torch-rocm-py312-rhel9:1791925861 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1791825469 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1791903880 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1791817064 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1791817844 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1791816223 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1791899290 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1791816175 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1791816316 | * |
| Red Hat Satellite 6.18 | RedHat | satellite/iop-advisor-backend-rhel9:1789666499 | * |
| Red Hat Satellite 6.19 | RedHat | satellite/iop-advisor-backend-rhel9:1789666498 | * |
| Sqlparse | Ubuntu | esm-infra/bionic | * |
| Sqlparse | Ubuntu | esm-infra/focal | * |
| Sqlparse | Ubuntu | jammy | * |
| Sqlparse | Ubuntu | noble | * |
| Sqlparse | Ubuntu | resolute | * |
| Sqlparse | Ubuntu | upstream | * |