GHSA-wjcc-cq79-p63f

Suggest an improvement
Source
https://github.com/advisories/GHSA-wjcc-cq79-p63f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-wjcc-cq79-p63f/GHSA-wjcc-cq79-p63f.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-wjcc-cq79-p63f
Aliases
Published
2023-10-31T22:22:50Z
Modified
2023-11-09T05:19:18.543960Z
Severity
  • 5.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF
Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.

That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations.

Patches

The issue was fixed with #2264

Workarounds

If you cannot update your version of pypdf, you should modify pypdf/generic/_data_structures.py just like #2264 did.

Database specific
{
    "nvd_published_at": "2023-10-31T16:15:09Z",
    "cwe_ids": [
        "CWE-835"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-31T22:22:50Z"
}
References

Affected packages

PyPI / pypdf

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.7.0
Fixed
3.17.0

Affected versions

3.*

3.7.0
3.7.1
3.8.0
3.8.1
3.9.0
3.9.1
3.10.0
3.11.0
3.11.1
3.12.0
3.12.1
3.12.2
3.13.0
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.15.5
3.16.0
3.16.1
3.16.2
3.16.3
3.16.4