CVE-2021-29510

Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

Pydantic es un sistema de validación de datos y gestión de configuraciones que utiliza las sugerencias de tipo de Python. En las versiones afectadas, pasar `'infinity'`, `'inf'` o `float('inf')` (o sus negativos) a los campos `datetime` o `date` hace que la validación se ejecute eternamente con un uso del 100% de la CPU (en una CPU). Pydantic ha sido parcheado con correcciones disponibles en las siguientes versiones: v1.8.2, v1.7.4, v1.6.2. Todas estas versiones están disponibles en pypi(https://pypi.org/project/pydantic/#history), y estarán disponibles en conda-forge(https://anaconda.org/conda-forge/pydantic) pronto. Consulta el registro de cambios(https://pydantic-docs.helpmanual.io/) para más detalles. Si no puedes actualizar absolutamente, puedes evitar este riesgo usando un validador(https://pydantic-docs.helpmanual.io/usage/validators/) para capturar estos valores. Esta no es una solución ideal (en particular, necesitarás una función ligeramente diferente para las fechas), en lugar de un hack como este deberías actualizar pydantic. Si no estás usando v1.8.x, v1.7.x o v1.6.x y no puedes actualizar a una versión fija de pydantic, por favor crea un issue en https://github.com/samuelcolvin/pydantic/issues solicitando un back-port, y nos esforzaremos en liberar un parche para versiones anteriores de pydantic

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-03-30 CVE Reserved
2021-05-13 CVE Published
2024-01-27 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CAPEC

References (5)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/samuelcolvin/pydantic/commit/7e83fdd2563ffac081db7ecdf1affa65ef38c468	2023-11-07
https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh	2023-11-07

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2HT266L6Q7H6ICP7DFGXOGBJHNNKMKB	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEFWM7DYKD2ZHE7R5YT5EQWJPV4ZKYRB	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMKAJX4O6IGBBCE32CO2G7PZQCCQSBLV	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pydantic Project Search vendor "Pydantic Project"		Pydantic Search vendor "Pydantic Project" for product "Pydantic"				< 1.6.2 Search vendor "Pydantic Project" for product "Pydantic" and version " < 1.6.2"		-		Affected
Pydantic Project Search vendor "Pydantic Project"		Pydantic Search vendor "Pydantic Project" for product "Pydantic"				>= 1.7 < 1.7.4 Search vendor "Pydantic Project" for product "Pydantic" and version " >= 1.7 < 1.7.4"		-		Affected
Pydantic Project Search vendor "Pydantic Project"		Pydantic Search vendor "Pydantic Project" for product "Pydantic"				>= 1.8 < 1.8.2 Search vendor "Pydantic Project" for product "Pydantic" and version " >= 1.8 < 1.8.2"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				33 Search vendor "Fedoraproject" for product "Fedora" and version "33"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected