PT-2017-4246 · Python+5 · Pypdf2+5
Sebastian Krause
·
Publicado
2017-02-17
·
Atualizado
2026-04-17
·
CVE-2022-24859
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
PyPDF2 versions prior to 1.27.5
Description
The issue is related to the
ContentStream. readInlineImage function in the PyPDF2 library, which can lead to an infinite loop if an attacker crafts a PDF that causes the code to attempt to get the content stream without properly checking if the stream has already ended. This can be exploited by a remote attacker to cause a denial of service using a specially created PDF file. The reason for this issue is that the last while-loop in ContentStream. readInlineImage only terminates when it finds the EI token, but never actually checks if the stream has already ended.Recommendations
For versions prior to 1.27.5, upgrade to version 1.27.5 or later to resolve the issue.
As a temporary workaround, consider validating PDFs prior to iterating over their content stream to minimize the risk of exploitation.
Exploit
Correção
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Linuxmint
Pypdf2
Red Os
Ubuntu