Detections
Analytics

SCA: security update for sqlparse (GHSA-p5w8-wqhj-9hhf)

high Tenable Cloud Security Plugin ID 417317

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a
 regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause
 exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the
 formatting feature that removes comments from SQL statements is affected by this regular expression. As a
 workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-
 comments command line flag when using the sqlformat command line tool. The issues has been fixed in
 sqlparse 0.4.2. (CVE-2021-32839)

See Also

https://github.com/advisories/GHSA-p5w8-wqhj-9hhf

Plugin Details

Severity: High

ID: 417317

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-32839

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/10/2021

Vulnerability Publication Date: 9/10/2021

Reference Information

CVE: CVE-2021-32839

cwe: CWE-400