CVE-2023-36810: Quadratic runtime with malformed PDF missing xref marker in pypdf
Impact An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.
Patches https://github.com/py-pdf/pypdf/pull/808
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?
References PyPDF2 PR #808 PyPDF2 Issue #582
Other sources
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/pypdf2to a version that resolves this vulnerability.Fixed in 1.26.0-2ubuntu0.1~ - Upgrade
Upgrade
ubuntu/pypdf2to a version that resolves this vulnerability.Fixed in 1.26.0-3ubuntu1.20.04.2 - Upgrade
Upgrade
ubuntu/pypdf2to a version that resolves this vulnerability.Fixed in 1.26.0-4ubuntu0.22.04.2 - Upgrade
Upgrade
ubuntu/pypdf2to a version that resolves this vulnerability.Fixed in 1.25.1-1ubuntu0.1~ - Upgrade
Upgrade
debian/pypdf2to a version that resolves this vulnerability.Fixed in 1.26.0-2+deb10u2Fixed in 2.12.1-3 - Upgrade
Upgrade
pip/PyPDF2to a version that resolves this vulnerability.Fixed in 1.27.9 - Upgrade
Upgrade
PyPDF2 (pypdf)to a version that resolves this vulnerability.Fixed in 1.27.9 - Upgrade
Upgrade
PyPDF2 (pypdf)to a version that resolves this vulnerability.Patch PR #808
Event History
Frequently Asked Questions
What is the impact of CVE-2023-36810?
An attacker can craft a PDF that leads to unexpected long runtime and utilizes 100% of a single CPU core.
How does CVE-2023-36810 affect the system's performance?
It blocks the current process and can cause high CPU usage.
What software is affected by CVE-2023-36810?
PyPDF2 versions up to and including 1.27.8, pypdf2 versions up to and including 1.26.0-2ubuntu0.1~, 1.26.0-3ubuntu1.20.04.2, 1.26.0-4ubuntu0.22.04.2, 1.25.1-1ubuntu0.1~, and pypdf versions up to and including 1.27.8.
How can I fix CVE-2023-36810?
Apply the corresponding patches or updates for the affected software versions, which can be found in the provided references.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-36810?
The CWE ID for CVE-2023-36810 is CWE-407 (Uncontrolled Resource Consumption).