UbuntuUpdates.org

Package "sqlformat"

Name: sqlformat

Description:

SQL formatting utility
Latest version: 0.4.4-1ubuntu0.2
Release: noble (24.04)
Level: security
Repository: universe
Head package: sqlparse
Homepage: https://github.com/andialbrecht/sqlparse

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "sqlformat"

All arch deb package
APT INSTALL

Other versions of "sqlformat" in Noble

Repository Area Version
base universe 0.4.4-1
updates universe 0.4.4-1ubuntu0.2
PPA: Postgresql 0.2.4-0.1~pgdg16.04+1

Changelog

Version: 0.4.4-1ubuntu0.2 2026-09-23 16:07:38 UTC

sqlparse (0.4.4-1ubuntu0.2) noble-security; urgency=medium

  * SECURITY UPDATE: Uncontrolled CPU consumption (algorithmic complexity)
    - debian/patches/CVE-2026-54284.patch: set a group's value from its
      child tokens instead of recomputing it via a full recursive
      flatten on every group construction in sqlparse/sql.py.
    - CVE-2026-54284
  * SECURITY UPDATE: Uncontrolled CPU consumption (algorithmic complexity)
    - debian/patches/CVE-2026-71491.patch: stop rescanning the remaining
      token tail once per comment token in group_comments in
      sqlparse/engine/grouping.py.
    - CVE-2026-71491
  * SECURITY UPDATE: Uncontrolled CPU consumption (ReDoS)
    - debian/patches/CVE-2026-59893.patch: bound backtracking when
      matching dollar-quoted literals and multiline comments in
      sqlparse/keywords.py, sqlparse/lexer.py and sqlparse/utils.py.
    - CVE-2026-59893

 -- Chrisa Oikonomou Tue, 22 Sep 2026 12:40:56 +0300
Source diff to previous version
CVE-2026-54284 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly
CVE-2026-71491 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-o
CVE-2026-59893 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/le

Version: 0.4.4-1ubuntu0.1 2024-05-13 15:07:01 UTC

  sqlparse (0.4.4-1ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2024-4340.patch: raise SQLParseError instead
      of RecursionError in sqlparse/sql.py, tests/test_regressions.py.
    - CVE-2024-4340

 -- Leonidas Da Silva Barbosa <email address hidden> Tue, 07 May 2024 09:47:27 -0300
CVE-2024-4340 Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.


About   -   Send Feedback to @ubuntu_updates