PyPi: Pydantic

CVE-2020-10735

Transitive

Safety vulnerability ID: 50916

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Sep 09, 2022 Updated at Apr 23, 2024
Scan your Python projects for vulnerabilities →

Advisory

Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735.
https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5

Affected package

pydantic

Latest version: 2.7.1

Data validation using Python type hints

Affected versions

Fixed versions

Vulnerability changelog

* **Revert Change:** Revert percent encoding of URL parts which was originally added in 4224, 4470 by samuelcolvin
* Prevent long (length > `4_300`) strings/bytes as input to int fields, see
[python/cpython95778](https://github.com/python/cpython/issues/95778) and
[CVE-2020-10735](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735), #1477 by samuelcolvin
* fix: dataclass wrapper was not always called, 4477 by PrettyWood
* Use `tomllib` on Python 3.11 when parsing `mypy` configuration, 4476 by hauntsaninja
* Basic fix of `GenericModel` cache to detect order of arguments in `Union` models, 4474 by sveinugu
* Fix mypy plugin when using bare types like `list` and `dict` as `default_factory`, 4457 by samuelcolvin

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

HIGH 7.5

CVSS v3 Details

HIGH 7.5
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Availability (A)
HIGH