GHSA-23w6-3w8w-8484: Pip/pypdf vulnerability
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3966] to mitigate the long runtimes and large memory consumption when processing crafted PDFs that access document outlines with lots of entries or nested outlines with long re-used nesting paths.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply a crafted PDF, and the application must access that document's outlines. The malicious PDF uses either many outline entries or deeply nested outlines with long reused nesting paths.
Which deployments are most exposed?
Deployments that process untrusted PDFs and access document outlines are exposed to the described resource-consumption behavior. The provided information does not establish whether merely opening or otherwise processing a PDF without accessing outlines is affected.
What should be done if an upgrade cannot be applied immediately?
Apply the changes from pypdf PR #3966 as a workaround. The issue is fixed in pypdf 6.16.1.