CVE-2023-36810
Medium
Description
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityMedium
CVSS6.2
Exploit probability—
ProductPypdf
PublishedJun 30, 2023
First seenJun 30, 2023
Weakness typeCWE-407CWE-407
How to fix
Update
- pypdf21.27.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypdf_project pypdf | v ≤ 1.27.8 | — |
| pypdf2PyPI | v < 1.27.9 | 1.27.9 |
| py-pdf pypdf | v ≤ 1.27.8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.