Bug ID

1216773

Summary

VUL-0: CVE-2023-36810: pypdf: An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime

Classification

openSUSE

Product

openSUSE Distribution

Version

Leap 15.6

Hardware

Other

URL

https://smash.suse.de/issue/371004/

Other

Status

NEW

Severity

Normal

Priority

P5 - None

Component

Python

Assignee

simonf.lees@suse.com

Reporter

smash_bz@suse.de

QA Contact

security-team@suse.de

stoyan.manolov@suse.com

Target Milestone

---

Found By

Security Response Team

Blocker

---

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and
transforming the pages of PDF files. An attacker who uses this vulnerability
can
craft a PDF which leads to unexpected long runtime. This quadratic runtime
blocks the current process and can utilize a single core of the CPU by 100%. It
does not affect memory usage. This issue has been addressed in PR 808 and
versions from 1.27.9 include this fix. Users are advised to upgrade. There are
no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36810