GHSA-5hx5-vpf9-5wcv: Input Validation
Impact
An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data).
Users which do not have the optional Pillow dependency installed in their environment are not affected.
Patches
This has been fixed in pypdf==6.21.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4222.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Patch #4222
Event History
Frequently Asked Questions
Which deployments are affected?
Only pypdf environments with the optional Pillow dependency installed are affected. Environments without Pillow are not affected.
What must an attacker provide to trigger the issue?
The attacker must be able to supply a crafted PDF that causes an image claiming to use the /DCTDecode (JPEG) filter to be loaded. This can result in arbitrary image parsers being called.
What should be done if upgrading is not immediately possible?
Apply the changes from PR #4222 as a workaround. The issue is fixed in pypdf 6.21.1.