From 420acd8735dd5d3bd0751928b65b87b94ede2b0c Mon Sep 17 00:00:00 2001 From: Narpat Mali Date: Wed, 31 May 2023 15:23:13 +0000 Subject: python3-sqlparse: fix for CVE-2023-30608 sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue. Signed-off-by: Narpat Mali Signed-off-by: Armin Kuster --- meta-python/recipes-devtools/python/python3-sqlparse_0.4.2.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta-python/recipes-devtools/python/python3-sqlparse_0.4.2.bb') diff --git a/meta-python/recipes-devtools/python/python3-sqlparse_0.4.2.bb b/meta-python/recipes-devtools/python/python3-sqlparse_0.4.2.bb index 0980ff9c24..b5cc41e730 100644 --- a/meta-python/recipes-devtools/python/python3-sqlparse_0.4.2.bb +++ b/meta-python/recipes-devtools/python/python3-sqlparse_0.4.2.bb @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2b136f573f5386001ea3b7b9016222fc" SRC_URI += "file://0001-sqlparse-change-shebang-to-python3.patch \ file://run-ptest \ + file://CVE-2023-30608.patch \ " SRC_URI[sha256sum] = "0c00730c74263a94e5a9919ade150dfc3b19c574389985446148402998287dae" -- cgit v1.2.3-54-g00ecf