Safety vulnerability ID: 59231
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Pypdf 3.9.0 includes a fix for CVE-2023-36464: In affected versions an attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users unable to upgrade may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")'.
https://github.com/py-pdf/pypdf/pull/1828
https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8
Latest version: 4.2.0
A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`. See CVE-2023-36464.
MISC:https://github.com/py-pdf/pypdf/pull/1828: https://github.com/py-pdf/pypdf/pull/1828
MISC:https://github.com/py-pdf/pypdf/pull/969: https://github.com/py-pdf/pypdf/pull/969
MISC:https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8: https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application