CVE-2021-29510
Summary
| CVE | CVE-2021-29510 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-05-13 19:15:00 UTC |
|---|
| Updated | 2023-11-07 03:32:00 UTC |
|---|
| Description | Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 34 Update: python-fastapi-0.65.1-2.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: python-pydantic-1.7.4-1.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Use of "infinity" as an input to datetime and date fields causes infinite loop · Advisory · samuelcolvin/pydantic · GitHub |
CONFIRM |
github.com |
|
| [SECURITY] Fedora 33 Update: python-pydantic-1.6.2-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Merge pull request from GHSA-5jqp-qgf6-3pvh · samuelcolvin/pydantic@7e83fdd · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 34 Update: python-fastapi-0.65.1-2.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: python-pydantic-1.7.4-1.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: python-pydantic-1.6.2-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 179985 Debian Security Update for pydantic (CVE-2021-29510)
- 200004 Ubuntu Security Notification for Pydantic Vulnerability (USN-6553-1)
- 281154 Fedora Security Update for python (FEDORA-2021-e7fabd81fb)
- 281161 Fedora Security Update for python (FEDORA-2021-f8bb3ba3ec)
- 281162 Fedora Security Update for python (FEDORA-2021-4d3de3183f)
- 980630 Python (pip) Security Update for pydantic (GHSA-5jqp-qgf6-3pvh)
