CVE-2021-29510

Pydantic version <=1.8.1 datetime validation CPU DoS with 'infinity'

• CVSS 7.5
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
• Input Validation and Sanitization
• Remote

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

CVE

CVE-2021-29510

CWE

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS base score

7.5

Published

2021-05-13

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Upgrade to Pydantic version 1.8.2, 1.7.4, or 1.6.2.

from datetime import datetime
from pydantic import BaseModel

class User(BaseModel):
    id: int
    signup_ts: datetime

user = User(id=1, signup_ts='infinity')

from datetime import datetime
from pydantic import BaseModel, validator, ValidationError

class User(BaseModel):
    id: int
    signup_ts: datetime

    @validator('signup_ts', pre=True)
    def check_datetime(cls, value):
        if value in {'infinity', 'inf', float('inf'), '-infinity', '-inf', -float('inf')}:
            raise ValueError("Invalid value for datetime: cannot be infinity")
        return value

try:
    user = User(id=1, signup_ts='infinity')
except ValidationError as e:
    print(e)

@misc{vaitp:cve202129510,
  title        = {{Pydantic version <=1.8.1 datetime validation CPU DoS with 'infinity'}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-29510},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-29510/}}
}