CVE-2023-36810
published 2023-06-30CVE-2023-36810: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.57%
42.7th percentile
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypdf2 | < pypdf2 1.27.9-1 (bookworm) | pypdf2 1.27.9-1 (bookworm) |
| py-pdf | pypdf | < 1.27.9 | 1.27.9 |
| pypdf2_project | pypdf2 | >= 0 < 1.26.0-4+deb11u1 | 1.26.0-4+deb11u1 |
| pypdf2_project | pypdf2 | >= 0 < 1.27.9-1 | 1.27.9-1 |
| pypdf2_project | pypdf2 | >= 0 < 1.27.9 | 1.27.9 |
| pypdf_project | pypdf | <= 1.27.8 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-36810: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
osv·2023-06-30·CVSS 6.5
CVE-2023-36810 [MEDIUM] CVE-2023-36810: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
GHSA
PyPDF2 quadratic runtime with malformed PDF missing xref marker
ghsa·2023-06-30
CVE-2023-36810 [MEDIUM] CWE-407 PyPDF2 quadratic runtime with malformed PDF missing xref marker
PyPDF2 quadratic runtime with malformed PDF missing xref marker
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.
This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.
### Patches
https://github.com/py-pdf/pypdf/pull/808
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
### References
* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)
* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)
OSV
PyPDF2 quadratic runtime with malformed PDF missing xref marker
osv·2023-06-30
CVE-2023-36810 [MEDIUM] PyPDF2 quadratic runtime with malformed PDF missing xref marker
PyPDF2 quadratic runtime with malformed PDF missing xref marker
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.
This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.
### Patches
https://github.com/py-pdf/pypdf/pull/808
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
### References
* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)
* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)
Ubuntu
PyPDF2 vulnerability
vendor_ubuntu·2023-08-10
CVE-2023-36810 PyPDF2 vulnerability
Title: PyPDF2 vulnerability
Summary: PyPDF2 could be made to crash if it opened a specially crafted
file.
It was discovered that PyPDF2 incorrectly handled PDF files with certain
markers. If a user or automated system were tricked into processing a
specially crafted file, an attacker could possibly use this issue to
consume system resources, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2023-36810: pypdf2 - pypdf is a pure-python PDF library capable of splitting, merging, cropping, and ...
vendor_debian·2023·CVSS 6.2
CVE-2023-36810 [MEDIUM] CVE-2023-36810: pypdf2 - pypdf is a pure-python PDF library capable of splitting, merging, cropping, and ...
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Scope: local
bookworm: resolved (fixed in 1.27.9-1)
bullseye: resolved (fixed in 1.26.0-4+deb11u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/py-pdf/pypdf/issues/582https://github.com/py-pdf/pypdf/pull/808https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqwhttps://lists.debian.org/debian-lts-announce/2023/07/msg00019.htmlhttps://github.com/py-pdf/pypdf/issues/582https://github.com/py-pdf/pypdf/pull/808https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqwhttps://lists.debian.org/debian-lts-announce/2023/07/msg00019.html
2023-06-30
Published