py-pdf pypdf _data_structures.py infinite loop

Summaryinfo

A vulnerability, which was classified as problematic, was found in py-pdf pypdf. This affects an unknown part of the file pypdf/generic/_data_structures.py. The manipulation results in infinite loop. This vulnerability is reported as CVE-2023-46250. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in py-pdf pypdf (affected version not known). Affected is some unknown functionality of the file pypdf/generic/_data_structures.py. The manipulation with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. CVE summarizes:

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.

The weakness was disclosed 10/31/2023 as GHSA-wjcc-cq79-p63f. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-46250 since 10/19/2023. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading eliminates this vulnerability. Applying the patch 9b23ac3c9619492570011d551d521690de9a3e2d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• py-pdf

Name

• pypdf

License

• open-source

Website

• Product: https://github.com/py-pdf/pypdf/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion