CVE-2023-36464

pypdf PDF library infinite loop vulnerability

• CVSS 5.5
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
• Input Validation and Sanitization
• Local

pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.

CVE

CVE-2023-36464

CWE

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS base score

5.5

Published

2023-06-27

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Local

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update pypdf to version containing pull request #1828.

def parse_content_stream(stream):
    """Vulnerable function that demonstrates the security issue."""
    while True:
        peek = stream.peek(1)
        if peek not in (b"\r", b"\n"):
            pass
        else:
            break

def parse_content_stream(stream):
    """Secure function that fixes the vulnerability."""
    while True:
        peek = stream.peek(1)
        if peek not in (b"\r", b"\n", b""):
            pass
        else:
            break

@misc{vaitp:cve202336464,
  title        = {{pypdf PDF library infinite loop vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-36464},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-36464/}}
}