CVE-2023-36464
Medium
Description
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.
SeverityMedium
CVSS6.2
Exploit probability—
ProductPypdf
PublishedJun 27, 2023
First seenJun 27, 2023
Weakness typeCWE-835CWE-835
How to fix
Update
- pypdf_project pypdf3.9.0 or later
- pypdf3.9.0 or later
- pypdf23.9.0 or later
- py-pdf pypdf3.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypdf_project pypdf | v < 3.9.0 | 3.9.0 |
| pypdf2_project pypdf2 | 2.2.0 ≤ v | — |
| pypdfPyPI | 3.1.0 ≤ v < 3.9.0 | 3.9.0 |
| pypdf2PyPI | 2.2.0 ≤ v ≤ 3.0.1, 2.2.0 ≤ v < 3.9.0 | 3.9.0 |
| py-pdf pypdf | v < 3.9.0 | 3.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.