GitHub Advisoryadvisory · PyPI

GHSA-wjcc-cq79-p63f Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF

MEDIUM Published 2023-10-31 Modified 2023-10-31 Official page ↗
Aliases
CVE-2023-46250
Ecosystem
PyPI
Packages
pypdf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2023-10-31

Affected packages

• PyPI pypdf: >= 3.7.0, < 3.17.0 → fixed in 3.17.0

Description

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. Patches The issue was fixed with #2264 Workarounds If you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py` just like #2264 did.

Related

Alias · CVE (1)

  • CVE-2023-46250 pypdf is a free and open-source pure-python PDF library. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References