CVE-2024-4340 : Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service d

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Published 2024-04-30 14:23:03

Updated 2024-04-30 17:52:35

Source JFrog

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2024-4340

Please log in to view affected product information.

EPSS FAQ

11.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	JFrog	2024-04-30
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	N/A	N/A	RedHat-CVE-2024-4340	2024-05-01
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-674 Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Assigned by: reefs@jfrog.com (Primary)

https://github.com/advisories/GHSA-2m57-hf25-phgg

sqlparse parsing heavily nested list leads to Denial of Service · GHSA-2m57-hf25-phgg · GitHub Advisory Database · GitHub
https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03

Raise SQLParseError instead of RecursionError. · andialbrecht/sqlparse@b4a39d9 · GitHub
https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/

sqlparse stack exhaustion DoS | JFSA-2024-001031292 - JFrog Security Research

Jump to