logo

Database

Improper resource allocation In pypdf2

Description

PyPDF2 quadratic runtime with malformed PDF missing xref marker

Impact

An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.

Patches

https://github.com/py-pdf/pypdf/pull/808

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2023-368102. NVD-2023-368103. OSV-2023-368104. OSV-DEBIAN-2023-368105. GHSA-jrm6-h9cq-8gqw6. GCVE-2023-368107. lists.debian.org8. SECURITY-TRACKER-CVE-2023-36810

References

1. https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw2. https://github.com/py-pdf/pypdf/issues/5823. https://github.com/py-pdf/pypdf/pull/8084. https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.