GitHub Advisoryadvisory · PyPI

GHSA-jrm6-h9cq-8gqw PyPDF2 quadratic runtime with malformed PDF missing xref marker

MEDIUM Published 2023-06-30 Modified 2023-06-30 Official page ↗
Aliases
CVE-2023-36810
Ecosystem
PyPI
Packages
PyPDF2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-407
Reviewed
2023-06-30

Affected packages

• PyPI PyPDF2: < 1.27.9 → fixed in 1.27.9

Description

Impact An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. Patches https://github.com/py-pdf/pypdf/pull/808 Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ References • PyPDF2 PR #808 • PyPDF2 Issue #582

Related

Alias · CVE (1)

  • CVE-2023-36810 pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. vulnerability

Weakness · CWE (1)

  • CWE-407 Inefficient Algorithmic Complexity weakness

References