PT-2023-29930 · Pypi · Pypdf

Alex Huszagh · Publicado 2023-10-31 · Atualizado 2023-11-08 · CVE-2023-46250

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Média

Vetor base

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pypdf versions 3.7.0 through 3.16.4

Description The issue allows an attacker to craft a PDF that leads to an infinite loop, blocking the current process and utilizing a single core of the CPU by 100%. This does not affect memory usage and can occur when a user manipulates an incoming malicious PDF, for example, by merging it with another PDF or by adding annotations.

Recommendations For versions 3.7.0 through 3.16.4, update to version 3.17.0 to resolve the issue. As a temporary workaround for versions 3.7.0 through 3.16.4, apply the patch manually by modifying pypdf/generic/ data structures.py.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2023-46250

GHSA-WJCC-CQ79-P63F

Produtos afetados

Pypdf

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46250.json · Exploit
• https://github.com/py-pdf/pypdf · Nota
• https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2d · Correção
• https://github.com/py-pdf/pypdf/pull/2264 · Correção
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63f · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-46250 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-46250 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1719423139849904467 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-wjcc-cq79-p63f · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46250 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-46250 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-46250 · Aviso do Fabricante
• https://t.me/cibsecurity/73260 · Publicação no Telegram