Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Pydantic is a data validation and settings management using Python type hinting. In affected versions
    passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields
    causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes
    available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on
    pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-
    forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-
    docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a
    validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an
    ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack
    like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to
    upgrade to a fixed version of pydantic, please create an issue at
    https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a
    patch for earlier versions of pydantic. (CVE-2021-29510)

The remote Ubuntu 20.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-6553-1 advisory.

    Nina Jensen discovered that Pydantic incorrectly handled user input in the date and datetime fields. An     attacker could possibly use this issue to cause a denial of service via application crash.
    (CVE-2021-29510)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410902	SCA: security update for pydantic (GHSA-5jqp-qgf6-3pvh)	Tenable Cloud Security	SCA Checks	medium
410902	SCA: security update for pydantic (GHSA-5jqp-qgf6-3pvh)	Tenable Self-Hosted Container Security	SCA Checks	medium
186772	Ubuntu 20.04 ESM : Pydantic vulnerability (USN-6553-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-29510

medium

Tenable Plugins

medium

medium

high