Detections
Analytics

Alpine: multiple py3-sqlparse packages: security update to 0.4.2-r0

high Tenable Self-Hosted Container Security Plugin ID 427225

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a
 regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause
 exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the
 formatting feature that removes comments from SQL statements is affected by this regular expression. As a
 workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-
 comments command line flag when using the sqlformat command line tool. The issues has been fixed in
 sqlparse 0.4.2. (CVE-2021-32839)

See Also

https://security.alpinelinux.org/vuln/CVE-2021-32839

Plugin Details

Severity: High

ID: 427225

Version: Revision 1.4

Type: Local

Published: 5/16/2025

Updated: 11/13/2025

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-32839

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/10/2021

Reference Information

CVE: CVE-2021-32839