Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Patches The issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 Workarounds If you cannot update your version of PyPDF2 (preferably to pypdf3.1.0 as PyPDF2 is deprecated), you should modify PyPDF2/generic/datastructures.py::readobject. Replace: by References pypdf issue #1329 pypdf PR #1331
Recommended action: Upgrade to 2.10.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. Patches https://github.com/py-pdf/pypdf/pull/808 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? References PyPDF2 PR #808 PyPDF2 Issue #582
Recommended action: Upgrade to 1.27.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code: Patches PyPDF2==1.27.5 and later are patched. Credits to Sebastian Krause for finding (issue) and fixing (PR) it.
Recommended action: Upgrade to 1.27.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.