Bug 2218075 (CVE-2023-36464)

Summary:	CVE-2023-36464 pypdf: Possible Infinite Loop when a comment isn't followed by a character
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdettelb
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the pyPDF package. In affected versions of the pyPDF package, this flaw allows an attacker to craft a PDF, which leads to an infinite loop if `__parse_content_stream` is executed.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2218077
Bug Blocks:	2218078

Description Avinash Hanwate 2023-06-28 04:53:48 UTC

pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.

https://github.com/py-pdf/pypdf/pull/969
https://github.com/py-pdf/pypdf/pull/1828
https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8

Comment 2 Avinash Hanwate 2023-06-28 04:55:56 UTC

Created python-PyPDF2 tracking bugs for this issue:

Affects: fedora-all [bug 2218077]