Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21690-1

Опубликовано: 30 авг. 2026
Источник: suse-cvrf

Описание

Security update for python-sqlparse

This update for python-sqlparse fixes the following issues:

  • CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption (bsc#1275459).
  • CVE-2026-59893: quadratic complexity when processing unmatched dollar-quoted literal and multiline-comment delimiters can lead to denial of service (bsc#1275461).
  • CVE-2026-59894: improper backlash escaping allows for injection of Python or PHP code via a crafted SQL input (bsc#1275460).
  • CVE-2026-71491: quadratic complexity in group_comments when processing comment-only statements can lead to denial of services (bsc#1275466).
  • Incomplete GHSA-27jp-wm6q-gp25 patch (bsc#1268597).

Список пакетов

openSUSE Leap 16.0
python313-sqlparse-0.5.3-160000.4.1

Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.

Затронутые продукты
openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1
Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

Затронутые продукты
openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1
Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.

Затронутые продукты
openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1
Ссылки

Описание

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.

Затронутые продукты
openSUSE Leap 16.0:python313-sqlparse-0.5.3-160000.4.1
Ссылки
Уязвимость openSUSE-SU-2026:21690-1