GitHub Advisoryadvisory · PyPI

GHSA-xcjx-m2pj-8g79 Manipulated inline images can cause Infinite Loop in PyPDF2

MEDIUM Published 2022-04-22 Modified 2024-10-14 Official page ↗
Aliases
CVE-2022-24859
Ecosystem
PyPI
Packages
PyPDF2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2022-04-22

Affected packages

• PyPI PyPDF2: < 1.27.5 → fixed in 1.27.5

Description

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code: ```python from PyPDF2 import PdfFileReader, PdfFileWriter from PyPDF2.pdf import ContentStream reader = PdfFileReader("malicious.pdf", strict=False) for page in reader.pages: ContentStream(page.getContents(), reader) ``` Patches `PyPDF2==1.27.5` and later are patched. Credits to Sebastian Krause for finding (issue) and fixing (PR) it.

Related

Alias · CVE (1)

  • CVE-2022-24859 PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References