Safety vulnerability ID: 40440
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
Latest version: 2.10.4
Data validation using Python type hints
!!! warning
A security vulnerability, level "moderate" is fixed in v1.8.2. Please upgrade **ASAP**.
See security advisory [CVE-2021-29510](https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh)
* **Security fix:** Fix `date` and `datetime` parsing so passing either `'infinity'` or `float('inf')`
(or their negative values) does not cause an infinite loop,
see security advisory [CVE-2021-29510](https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh)
* fix schema generation with Enum by generating a valid name, 2575 by PrettyWood
* fix JSON schema generation with a `Literal` of an enum member, 2536 by PrettyWood
* Fix bug with configurations declarations that are passed as
keyword arguments during class creation, 2532 by uriyyo
* Allow passing `json_encoders` in class kwargs, 2521 by layday
* support arbitrary types with custom `__eq__`, 2483 by PrettyWood
* support `Annotated` in `validate_arguments` and in generic models with python 3.9, 2483 by PrettyWood
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application