CVE-2023-36810

2023-06-3019:15:09

CWE-407

[email protected]

web.nvd.nist.gov

pypdf

pdf

library

fix

cve-2023-36810

vulnerability

upgrade

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Vulners

NVD

Node

py-pdfpypdfRange<1.27.9

CPENameOperatorVersion
pypdf_project:pypdfpypdf project pypdfle1.27.8

CPE	Name	Operator	Version
pypdf_project:pypdf	pypdf project pypdf	le	1.27.8

CNA Affected

[
  {
    "vendor": "py-pdf",
    "product": "pypdf",
    "versions": [
      {
        "version": "< 1.27.9",
        "status": "affected"
      }
    ]
  }
]