Most recent entries from all

bdu:2025-01019

BREW-athenacli-CVE-2024-4340 — sqlparse parsing heavily nested list leads to Denial of Service

Affected: Homebrew: athenacli

### Summary Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

### Details + PoC Running the following code will raise Maximum recursion limit exceeded exception: ```py import sqlparse sqlparse.parse('[' * 10000 + ']' * 10000) ``` We expect a traceback of RecursionError: ```py Traceback (most recent call last): File "trigger_sqlparse_nested_list.py", line 3, in <module> sqlparse.parse('[' * 10000 + ']' * 10000) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/__init__.py", line 30, in parse return tuple(parsestream(sql, encoding)) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/filter_stack.py", line 36, in run stmt = grouping.group(stmt) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 428, in group func(stmt) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 53, in group_brackets _group_matching(tlist, sql.SquareBrackets) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 48, in _group_matching tlist.group_tokens(cls, open_idx, close_idx) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 328, in group_tokens grp = grp_cls(subtokens) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 161, in __init__ super().__init__(None, str(self)) File "/home/uriya/.local/lib/python3.1…

certfr-2025-avi-0233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0233

EUVD-2026-258666

fkie_cve-2024-4340

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

GHSA-2m57-hf25-phgg — sqlparse parsing heavily nested list leads to Denial of Service

Affected: PyPI: sqlparse

### Summary Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

OESA-2024-1533 — python-sqlparse security update

Affected: openEuler:20.03-LTS-SP4: python-sqlparse, openEuler:22.03-LTS: python-sqlparse, openEuler:22.03-LTS-SP1: python-sqlparse, openEuler:22.03-LTS-SP2: python-sqlparse

``sqlparse`` is a non-validating SQL parser module. It provides support for parsing, splitting and formatting SQL statements. Security Fix(es): Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. (CVE-2024-4340)

PYSEC-2026-1940 — sqlparse parsing heavily nested list leads to Denial of Service

Affected: PyPI: sqlparse

### Summary Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

RHSA-2024:3781 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

pip: Mercurial configuration injectable in repo revision when installing via pip golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm python-cryptography: NULL-dereference when loading PKCS7 certificates pillow: Arbitrary Code Execution via the environment parameter python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() python-pydantic: regular expression denial of service via crafted email string sqlparse: parsing heavily nested list leads to denial of service psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override aiohttp: XSS on index pages for static file handling python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words() python-pillow: buffer overflow in _imagingcms.c follow-redirects: Possible credential leak aiohttp: DoS when trying to parse malformed POST requests python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django jinja2: accept…

UBUNTU-CVE-2024-4340

Affected: Ubuntu:22.04:LTS: sqlparse, Ubuntu:24.04:LTS: sqlparse

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

WID-SEC-W-2024-1328 — Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder Cross-Site-Scripting (XSS)-Angriffe durchzuführen.