pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Pypdf Project |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3497-1 | pypdf2 security update |
 EUVD |
EUVD-2023-1837 | pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
 Github GHSA |
GHSA-jrm6-h9cq-8gqw | PyPDF2 quadratic runtime with malformed PDF missing xref marker |
 Ubuntu USN |
USN-6280-1 | PyPDF2 vulnerability |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 04 Nov 2024 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-02-13T16:56:24.866Z
Reserved: 2023-06-27T15:43:18.383Z
Link: CVE-2023-36810
Vulnrichment
Updated: 2024-08-02T17:01:09.825Z
NVD
Status : Modified
Published: 2023-06-30T19:15:09.357
Modified: 2024-11-21T08:10:38.660
Link: CVE-2023-36810
Redhat
No data.
OpenCVE Enrichment
No data.