Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-29510— Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic

Quick assessment

Affected
samuelcolvin pydantic
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pydantic是一个应用软件。使用Python类型提示进行数据验证和设置管理。 Pydantic 存在安全漏洞。该漏洞源于程序的验证将永远以100％的CPU使用率运行。

CVSS 3.3 · Low EPSS 0.97% · P61

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-29510

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic
Source: CVE Program / CVE List V5
Vulnerability Description
Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Vulnerability Title
pydantic 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pydantic是一个应用软件。使用Python类型提示进行数据验证和设置管理。 Pydantic 存在安全漏洞。该漏洞源于程序的验证将永远以100％的CPU使用率运行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
samuelcolvin pydantic >= 1.8.0, < 1.8.2 -

II. Public POCs for CVE-2021-29510

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-29510

请登录查看更多情报信息。

Patches & Fixes for CVE-2021-29510 (1)

Vendor Advisories for CVE-2021-29510 (1)

Mailing List Discussions for CVE-2021-29510 (3)

IV. Related Vulnerabilities

Same product: pydantic
Same weakness: CWE-835

V. Comments for CVE-2021-29510

No comments yet

Leave a comment