PT-2020-6937 · Pypi+3 · Pypdf+3

Martin Thoma · Published 2020-11-13 · Updated 2023-09-11 · CVE-2023-36810

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 1.27.9

Description The issue is related to algorithmic complexity in the pypdf library, which can be exploited by an attacker to craft a PDF that leads to unexpected long runtime, blocking the current process and utilizing a single core of the CPU by 100%. This does not affect memory usage.

Recommendations For versions prior to 1.27.9, upgrade to version 1.27.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the pypdf library until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-407

Related Identifiers

BDU:2023-07658

CVE-2023-36810

DLA-3497-1

GHSA-JRM6-H9CQ-8GQW

MGASA-2023-0254

USN-6280-1

Affected Products

Astra Linux

Linuxmint

Ubuntu

Pypdf

References · 28

• 🔥 https://github.com/py-pdf/pypdf/issues/582 · Exploit
• 🔥 https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36810.json · Exploit
• https://github.com/py-pdf/pypdf/pull/808 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-36810 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-36810 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0254.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-36810 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36810 · Security Note
• https://debian.org/lts/security/2023/dla-3497 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6280-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-36810 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-36810 · Security Note