GHSA-xcjx-m2pj-8g79MediumCVSS 6.2

Manipulated inline images can cause Infinite Loop in PyPDF2

Published
April 22, 2022
Last Modified
October 14, 2024

🔗 CVE IDs covered (1)

CVE-2022-24859 →

📋 Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code:

from PyPDF2 import PdfFileReader, PdfFileWriter
from PyPDF2.pdf import ContentStream

reader = PdfFileReader("malicious.pdf", strict=False)
for page in reader.pages:
    ContentStream(page.getContents(), reader)

Patches

PyPDF2==1.27.5 and later are patched.

Credits to Sebastian Krause for finding (issue) and fixing (PR) it.

🎯 Affected products1

  • pip/PyPDF2:< 1.27.5

🔗 References (9)