Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=scarthgap 2024-08-03T15:56:05+00:00 2024-08-03T15:56:05+00:00 Soumya Sambu soumya.sambu@windriver.com 2024-07-26T12:04:24+00:00 urn:sha1:cffdfd0d699829f5ee7a0a59a6573cc6ed2601c4 Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. References: https://nvd.nist.gov/vuln/detail/CVE-2024-4340 Upstream-patch: https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> 2024-02-17T00:42:36+00:00 Tim Orling ticotimo@gmail.com 2024-02-17T00:15:31+00:00 urn:sha1:adc660605e0e2b8f5103f2d249a532f31c180092 * Also replace ${PYTHON_PN} with python3 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2023-07-25T19:46:19+00:00 Trevor Gamblin tgamblin@baylibre.com 2023-07-25T19:09:43+00:00 urn:sha1:74e70284acb2eb2f2a47a1ab1aa5ee0928d46344 - Use python_flit_core instead of setuptools3 - Modify 0001-sqlparse-change-shebang-to-python3.patch to apply on 0.4.4 - Remove CVE-2023-30608.patch since it's now upstream: [tgamblin@megalith sqlparse]$ git tag --contains c457abd 0.4.4 Changelog (https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG): Release 0.4.4 (Apr 18, 2023) ---------------------------- Notable Changes * IMPORTANT: This release fixes a security vulnerability in the parser where a regular expression vulnerable to ReDOS (Regular Expression Denial of Service) was used. See the security advisory for details: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 The vulnerability was discovered by @erik-krogh from GitHub Security Lab (GHSL). Thanks for reporting! Bug Fixes * Revert a change from 0.4.0 that changed IN to be a comparison (issue694). The primary expectation is that IN is treated as a keyword and not as a comparison operator. That also follows the definition of reserved keywords for the major SQL syntax definitions. * Fix regular expressions for string parsing. Other * sqlparse now uses pyproject.toml instead of setup.cfg (issue685). Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>