~ / search / GHSA-xcjx-m2pj-8g79

GHSA-xcjx-m2pj-8g79

Manipulated inline images can cause Infinite Loop in PyPDF2

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-24859

Packages

EcosystemPackageAffectedFixed in
PyPI PyPDF2 < 1.27.5 1.27.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code: ```python from PyPDF2 import PdfFileReader, PdfFileWriter from PyPDF2.pdf import ContentStream reader = PdfFileReader("malicious.pdf", strict=False) for page in reader.pages: ContentStream(page.getContents(), reader) ``` ### Patches [`PyPDF2==1.27.5`](https://pypi.org/project/PyPDF2) and later are patched. Credits to [Sebastian Krause](https://github.com/sekrause) for finding ([issue](https://github.com/py-pdf/PyPDF2/issues/329)) and fixing ([PR](https://github.com/py-pdf/PyPDF2/pull/740)) it.

References

External links from the advisory. They lead to third-party sites.