GHSA-fc8x-2rww-xw9m: Pip/pypdf vulnerability
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to readuntilwhitespace with an input which does not have whitespace for a long time.
Patches This has been fixed in pypdf==6.15.0.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3947.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.15.0 - Compensating control
If you cannot upgrade yet, apply the workaround changes from PR [#3947] to prevent crafted PDFs from causing long runtimes via a call to read_until_whitespace with input that lacks whitespace for a long time.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using pypdf that process attacker-controlled or otherwise untrusted PDF files are exposed, particularly where parsing can be triggered automatically or on demand.
What must an attacker provide to trigger the problem?
The attacker must provide a crafted PDF that causes read_until_whitespace to process input with no whitespace for a long time, resulting in a long runtime.
What should teams do if they cannot upgrade immediately?
Consider applying the changes from PR #3947 as a workaround until pypdf can be upgraded to version 6.15.0.