CVE-2023-30608

描述

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

如何修補 CVE-2023-30608

要修補 CVE-2023-30608,請將受影響套件升級到下列已修補版本。

• —升級至 0.4.1-1+deb11u1 或更新版本
• —升級至 0.2.4-1+deb10u1 或更新版本
• —升級至 0.4.4 或更新版本
• —升級至 c457abd5f097dd13fb21543381e7cfafe7d31cfb 或更新版本

CVE-2023-30608 正在被利用嗎?

低 — EPSS 為 1.0%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 0.4.1-1+deb11u1
• from 0, < 0.2.4-1+deb10u1
• >= 0.1.15, < 0.4.4
• from 0, < c457abd5f097dd13fb21543381e7cfafe7d31cfb, < e75e35869473832a1eb67772b1adfee2db11b85a | >= 0.1.15, < 0.4.4

CVSS 分數

參考連結(10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-30608
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-30608
• PATCHgithub.com/andialbrecht/sqlparse
• WEBgithub.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb