Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3762-1

Опубликовано: 24 авг. 2026
Источник: suse-cvrf

Описание

Security update for python-sqlparse

This update for python-sqlparse fixes the following issues:

  • CVE-2026-54284: TokenList.init materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger (bsc#1275459).
  • CVE-2026-59893: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (bsc#1275461).
  • CVE-2026-59894: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes (bsc#1275460).
  • CVE-2026-71491: quadratic O(n2) DoS in group_comments (bsc#1275466).

Список пакетов

SUSE Linux Enterprise Module for Package Hub 15 SP7
python2-sqlparse-0.2.4-150100.6.11.1

Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python2-sqlparse-0.2.4-150100.6.11.1
Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python2-sqlparse-0.2.4-150100.6.11.1
Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python2-sqlparse-0.2.4-150100.6.11.1
Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python2-sqlparse-0.2.4-150100.6.11.1
Ссылки