CVE-2023-36810: Quadratic runtime with malformed PDF missing xref marker in pypdf
First published: Fri Jun 30 2023(Updated: )
### Impact An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. ### Patches https://github.com/py-pdf/pypdf/pull/808 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### References * [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808) * [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ubuntu/pypdf2 | <1.26.0-2ubuntu0.1~ | 1.26.0-2ubuntu0.1~ |
| ubuntu/pypdf2 | <1.26.0-3ubuntu1.20.04.2 | 1.26.0-3ubuntu1.20.04.2 |
| ubuntu/pypdf2 | <1.26.0-4ubuntu0.22.04.2 | 1.26.0-4ubuntu0.22.04.2 |
| ubuntu/pypdf2 | <1.25.1-1ubuntu0.1~ | 1.25.1-1ubuntu0.1~ |
| debian/pypdf2 | <=1.26.0-2<=1.26.0-4 | 1.26.0-2+deb10u2 2.12.1-3 |
| Pypdf Project Pypdf | <=1.27.8 | |
| pip/PyPDF2 | <=1.27.8 | 1.27.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/py-pdf/pypdf/issues/582
- https://github.com/py-pdf/pypdf/pull/808
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
- https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html
- https://launchpad.net/bugs/cve/CVE-2023-36810
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36810
- https://ubuntu.com/security/notices/USN-6280-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-36810
- https://security-tracker.debian.org/tracker/CVE-2023-36810
- https://ubuntu.com/security/CVE-2023-36810
- https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373
- https://github.com/advisories/GHSA-jrm6-h9cq-8gqw (Advisory)
Frequently Asked Questions
What is the impact of CVE-2023-36810?
An attacker can craft a PDF that leads to unexpected long runtime and utilizes 100% of a single CPU core.
How does CVE-2023-36810 affect the system's performance?
It blocks the current process and can cause high CPU usage.
What software is affected by CVE-2023-36810?
PyPDF2 versions up to and including 1.27.8, pypdf2 versions up to and including 1.26.0-2ubuntu0.1~, 1.26.0-3ubuntu1.20.04.2, 1.26.0-4ubuntu0.22.04.2, 1.25.1-1ubuntu0.1~, and pypdf versions up to and including 1.27.8.
How can I fix CVE-2023-36810?
Apply the corresponding patches or updates for the affected software versions, which can be found in the provided references.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-36810?
The CWE ID for CVE-2023-36810 is CWE-407 (Uncontrolled Resource Consumption).
- collector/launchpad-cve
- collector/usn-cve
- collector/security-tracker-debian
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-jrm6-h9cq-8gqw
- alias/CVE-2023-36810
- collector/github-advisory
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/tags
- agent/trending
- package-manager/ubuntu
- package-manager/debian
- vendor/pypdf project
- canonical/pypdf project pypdf
- version/pypdf project pypdf/1.27.8
- package-manager/pip