PT-2023-19791 · Pdfio+1 · Pdfio+1

Cyberitech · Published 2023-02-07 · Updated 2023-03-24 · CVE-2023-24808

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PDFio versions prior to 1.1.0

Description A denial of service (DOS) issue exists in the pdfio parser. Crafted PDF files can cause the program to run at 100% utilization and never terminate. The problematic PDF is about 28kb in size and was discovered via fuzzing. Anyone using this library, either as a standalone binary or as a library, can be affected when attempting to parse this type of file. Web servers or automated processes relying on this code to turn PDF submissions into plaintext can also be affected when an attacker uploads the PDF.

Recommendations To resolve the issue, upgrade to version 1.1.0 or later. As a temporary workaround, consider restricting the parsing of PDF files from untrusted sources until a patch is available. Avoid using the pdfio parser for automated PDF processing until the issue is resolved. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2023-24808

GHSA-CJC4-X96X-FVGF

Affected Products

Debian

Pdfio

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24808.json · Exploit
• 🔥 https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-cjc4-x96x-fvgf · Exploit
• https://github.com/michaelrsweet/pdfio/commit/4f10021e7ee527c1aa24853e2947e38e154d9ccb · Patch
• https://ubuntu.com/security/CVE-2023-24808 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24808 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-24808 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-24808 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24808 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-24808 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-24808 · Vendor Advisory
• https://t.me/cvenotify/46799 · Telegram Post
• https://t.me/cibsecurity/57641 · Telegram Post
• https://t.me/cibsecurity/60321 · Telegram Post