Manipulated inline images can cause Infinite Loop in PyPDF2
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code: ```python from PyPDF2 import PdfFileReader, PdfFileWriter from PyPDF2.pdf import ContentStream reader = PdfFileReader("malicious.pdf", strict=False) for page in reader.pages: ContentStream(page.getContents(), reader) ``` ### Patches [`PyPDF2==1.27.5`](https://pypi.org/project/PyPDF2) and later are patched. Credits to [Sebastian Krause](https://github.com/sekrause) for finding ([issue](https://github.com/py-pdf/PyPDF2/issues/329)) and fixing ([PR](https://github.com/py-pdf/PyPDF2/pull/740)) it.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-24859US | medium5.5 | — | ||
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/py-pdf/PyPDF2PACKAGE
- https://github.com/py-pdf/PyPDF2/issues/329WEB
- https://github.com/py-pdf/PyPDF2/pull/740WEB
- https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5WEB
- https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/pypdf2/PYSEC-2022-194.yamlWEB
- https://lists.debian.org/debian-lts-announce/2022/06/msg00001.htmlWEB
- https://lists.debian.org/debian-lts-announce/2023/06/msg00013.htmlWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan