CVE-2023-36807
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The pypdf library in version 2.10.5 contains a vulnerability that allows an attacker to craft a PDF leading to an infinite loop. This loop blocks the current process and utilizes 100% of a single CPU core.
Risk Assessment
Organizations may experience significant delays in system operations, potentially leading to disruptions and decreased performance.
Recommendation
It is recommended to upgrade to version 2.10.6, which fixes this vulnerability. Users unable to upgrade should modify the `PyPDF2/generic/_data_structures.py` file to introduce an error-throwing case.
Original NVD description (English source)
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Versions prior to 2.10.5 throw an error, but do not hang forever. This issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 which has been included in release 2.10.6. Users are advised to upgrade. Users unable to upgrade should modify `PyPDF2/generic/_data_structures.py::read_object` to an an error throwing case. See GHSA-hm9v-vj3r-r55m for details.