PyPi: Pydantic

CVE-2021-29510

Safety vulnerability ID: 40440

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at May 13, 2021 Updated at Dec 18, 2024
Scan your Python projects for vulnerabilities →

Advisory

Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

Affected package

pydantic

Latest version: 2.10.4

Data validation using Python type hints

Affected versions

Fixed versions

Vulnerability changelog

!!! warning
A security vulnerability, level "moderate" is fixed in v1.8.2. Please upgrade **ASAP**.
See security advisory [CVE-2021-29510](https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh)

* **Security fix:** Fix `date` and `datetime` parsing so passing either `'infinity'` or `float('inf')`
(or their negative values) does not cause an infinite loop,
see security advisory [CVE-2021-29510](https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh)
* fix schema generation with Enum by generating a valid name, 2575 by PrettyWood
* fix JSON schema generation with a `Literal` of an enum member, 2536 by PrettyWood
* Fix bug with configurations declarations that are passed as
keyword arguments during class creation, 2532 by uriyyo
* Allow passing `json_encoders` in class kwargs, 2521 by layday
* support arbitrary types with custom `__eq__`, 2483 by PrettyWood
* support `Annotated` in `validate_arguments` and in generic models with python 3.9, 2483 by PrettyWood

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

HIGH 7.5

CVSS v3 Details

HIGH 7.5
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Availability (A)
HIGH

CVSS v2 Details

MEDIUM 5.0
Access Vector (AV)
NETWORK
Access Complexity (AC)
LOW
Authentication (Au)
NONE
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Impact (A)
PARTIAL