PT-2022-7123 · Pypi+1 · Pypdf+1

Exiledkingcc · Published 2022-06-10 · Updated 2026-04-29 · CVE-2023-36464

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 3.9.0

Description The issue is related to the execution of parse content stream which can lead to an infinite loop if a crafted PDF is used. This can occur, for example, when a user extracts text from such a PDF. The infinite loop can block the current process and utilize a single core of the CPU by 100%. It does not affect memory usage.

Recommendations For versions prior to 3.9.0, upgrade to pypdf>=3.9.0 to resolve the issue. If you cannot update your version of pypdf, modify the line while peek not in (b"r", b" ") in pypdf/generic/ data structures.py to while peek not in (b"r", b" ", b"").

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2023-07657

CVE-2023-36464

GHSA-4VVM-4W3V-6MR8

Affected Products

Astra Linux

Pypdf

References · 21

• 🔥 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36464.json · Exploit
• https://github.com/py-pdf/pypdf/pull/969 · Patch
• https://github.com/py-pdf/pypdf/pull/1828 · Patch
• https://osv.dev/vulnerability/CVE-2023-36464 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-36464 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-36464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36464 · Security Note
• https://osv.dev/vulnerability/GHSA-4vvm-4w3v-6mr8 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-36464 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-36464 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-36464 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-36464 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07657 · Security Note