CVE-2021-32839

SQLparse 0.4.0 and 0.4.1: RegEx DoS in comments

• CVSS 7.5
• CWE-400 Uncontrolled Resource Consumption
• Input Validation and Sanitization
• Remote

sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the –strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.

CVE

CVE-2021-32839

CWE

CWE-400 Uncontrolled Resource Consumption

CVSS base score

7.5

Published

2021-09-20

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to sqlparse version 0.4.2 or higher.

import sqlparse

sql = """
-- This is a comment
SELECT * FROM users;  -- Another comment
-- Repeated comments
""" + "\r\n" * 1000

formatted_sql = sqlparse.format(sql, strip_comments=True)
print(formatted_sql)

import sqlparse

sql = """
-- This is a comment
SELECT * FROM users;  -- Another comment
"""

formatted_sql = sqlparse.format(sql, strip_comments=False)
print(formatted_sql)

@misc{vaitp:cve202132839,
  title        = {{SQLparse 0.4.0 and 0.4.1: RegEx DoS in comments}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-32839},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-32839/}}
}