Denial of Service Vulnerability in Pydantic Package
Summary
DEBIAN-CVE-2024-3772: Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string. Affects pydantic versions < 1.10.13-0.1. Fixed in 1.10.13-0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pydantic is a data validation and settings management library for Python, which allows users to define data models using Python type annotations. It is widely used for its ease of use and powerful features, such as automatic data parsing and validation. However, versions prior to 2.4.0 and 1.10.13 are vulnerable to a regular expression denial of service (ReDoS) attack, which can be exploited through crafted input, such as email strings.
Vulnerability Detail
The vulnerability arises from the way Pydantic handles regular expressions in its validation processes. Attackers can craft specific email strings that, when processed by Pydantic, cause excessive backtracking in the regex engine, leading to a denial of service. This can result in the application becoming unresponsive, affecting availability and user experience. The vulnerability is present in Pydantic versions below 2.4.0 and 1.10.13.
How To Fix
Minimum fixed version
1.10.13-0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pydanticTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation to sanitize email strings before they are processed by Pydantic. This can help mitigate the risk of denial of service attacks.
Conclusion
The vulnerability in Pydantic poses a significant risk of denial of service due to improper handling of regular expressions. It is crucial to update to the patched version to ensure the security and availability of applications using this library. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for pydantic →
FAQ
A denial of service attack aims to make a service unavailable to its intended users by overwhelming it with traffic or exploiting vulnerabilities.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Failing to address this vulnerability can lead to service outages, impacting user experience and potentially causing loss of revenue.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without signing up.
Implement input validation to sanitize email strings and reduce the risk of denial of service attacks until you can update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydantic.
