PT-2017-4246 · Python+5 · Pypdf2+5
Sebastian Krause
·
Published
2017-02-17
·
Updated
2026-04-17
·
CVE-2022-24859
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
PyPDF2 versions prior to 1.27.5
Description
The issue is related to the
ContentStream. readInlineImage function in the PyPDF2 library, which can lead to an infinite loop if an attacker crafts a PDF that causes the code to attempt to get the content stream without properly checking if the stream has already ended. This can be exploited by a remote attacker to cause a denial of service using a specially created PDF file. The reason for this issue is that the last while-loop in ContentStream. readInlineImage only terminates when it finds the EI token, but never actually checks if the stream has already ended.Recommendations
For versions prior to 1.27.5, upgrade to version 1.27.5 or later to resolve the issue.
As a temporary workaround, consider validating PDFs prior to iterating over their content stream to minimize the risk of exploitation.
Exploit
Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Pypdf2
Red Os
Ubuntu