CVE-2021-32839
📋 TL;DR
CVE-2021-32839 is a regular expression denial of service (ReDoS) vulnerability in sqlparse, a Python SQL parser library. The vulnerability allows attackers to cause excessive CPU consumption and service disruption by providing SQL comments containing many repetitions of '\r\n'. This affects Python applications using sqlparse's formatting feature with comment stripping enabled.
💻 Affected Systems
- sqlparse
📦 What is this software?
Sqlparse by Sqlparse Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting all users of the application until the process is restarted.
Likely Case
Degraded performance or temporary service disruption for users when processing malicious SQL input with the vulnerable formatting feature.
If Mitigated
No impact if comment stripping is disabled or the vulnerable function is not used.
🎯 Exploit Status
Exploitation requires providing SQL input with many '\r\n' sequences in comments to the vulnerable formatting function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.2
Vendor Advisory: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf
Restart Required: No
Instructions:
1. Update sqlparse using pip: 'pip install --upgrade sqlparse>=0.4.2' 2. Verify the update with: 'pip show sqlparse' 3. Test that SQL formatting with comment stripping works correctly.
🔧 Temporary Workarounds
Disable comment stripping
allAvoid using the vulnerable comment stripping feature in sqlparse formatting functions.
Do not use strip_comments=True in sqlformat.format()
Do not use --strip-comments flag with sqlformat CLI
🧯 If You Can't Patch
- Disable or restrict use of sqlformat.format() with strip_comments=True in application code.
- Implement input validation to reject SQL containing excessive '\r\n' sequences in comments.
🔍 How to Verify
Check if Vulnerable:
Check sqlparse version: 'pip show sqlparse | grep Version' - if version is 0.4.0 or 0.4.1, system is vulnerable.Check Version:
pip show sqlparse | grep VersionVerify Fix Applied:
Verify sqlparse version is 0.4.2 or higher: 'pip show sqlparse | grep Version'📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes when processing SQL input
- Application timeouts or crashes during SQL formatting operations
Network Indicators:
- Unusually large SQL payloads containing many line breaks in comments
SIEM Query:
Process monitoring for high CPU usage by Python processes running sqlparse functions🔗 References
- https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
- https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf
- https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
- https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf
- https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html
