UbuntuUpdates.org

Package "sqlformat"

Name: sqlformat

Description:

SQL formatting utility
Latest version: 0.5.4-1ubuntu0.1
Release: resolute (26.04)
Level: security
Repository: universe
Head package: sqlparse
Homepage: https://github.com/andialbrecht/sqlparse

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "sqlformat"

All arch deb package
APT INSTALL

Other versions of "sqlformat" in Resolute

Repository Area Version
base universe 0.5.4-1
PPA: Postgresql 0.2.4-0.1~pgdg16.04+1

Changelog

Version: 0.5.4-1ubuntu0.1 2026-09-23 16:07:44 UTC

sqlparse (0.5.4-1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Uncontrolled CPU consumption (algorithmic complexity)
    - debian/patches/CVE-2026-54284.patch: set a group's value from its
      child tokens instead of recomputing it via a full recursive
      flatten on every group construction in sqlparse/sql.py.
    - CVE-2026-54284
  * SECURITY UPDATE: Uncontrolled CPU consumption (algorithmic complexity)
    - debian/patches/CVE-2026-71491.patch: stop rescanning the remaining
      token tail once per comment token in group_comments in
      sqlparse/engine/grouping.py.
    - CVE-2026-71491
  * SECURITY UPDATE: Uncontrolled CPU consumption (ReDoS)
    - debian/patches/CVE-2026-59893.patch: bound backtracking when
      matching dollar-quoted literals and multiline comments in
      sqlparse/keywords.py, sqlparse/lexer.py and sqlparse/utils.py.
    - CVE-2026-59893

 -- Chrisa Oikonomou Tue, 22 Sep 2026 12:40:54 +0300
CVE-2026-54284 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly
CVE-2026-71491 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-o
CVE-2026-59893 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/le


About   -   Send Feedback to @ubuntu_updates