GHSA-jp53-mhqp-8xcg: Pip/pypdf vulnerability
Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (usually writing) code path where TreeObject.insertchild is involved.
Patches
This has been fixed in pypdf==6.16.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3964.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.16.0 - Upgrade
Upgrade
py-pdf/pypdfto a version that resolves this vulnerability.Fixed in 6.16.0
Event History
Frequently Asked Questions
Which pypdf uses are exposed to this issue?
The issue requires a code path involving TreeObject.insert_child, usually during PDF-writing operations. Uses that do not invoke this path are not described as affected.
What does an attacker need to provide to trigger the problem?
An attacker needs to craft a PDF that reaches the affected TreeObject.insert_child code path. Successful triggering leads to an infinite loop.
What can I do if I cannot upgrade immediately?
Upgrade to pypdf 6.16.0, which includes the fix. If upgrading is not currently possible, apply the changes from PR #3964.