What is GHSA-jrm6-h9cq-8gqw?

GHSA-jrm6-h9cq-8gqw is a security advisory published by GitHub Security Advisories with Medium severity. PyPDF2 quadratic runtime with malformed PDF missing xref marker

Which CVE IDs does GHSA-jrm6-h9cq-8gqw cover?

GHSA-jrm6-h9cq-8gqw covers the following CVE IDs: CVE-2023-36810. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jrm6-h9cq-8gqw?

GHSA-jrm6-h9cq-8gqw has a CVSS v3 base score of 6.2, published by GitHub Security Advisories.

Which products are affected by GHSA-jrm6-h9cq-8gqw?

GHSA-jrm6-h9cq-8gqw affects 1 product, including: pip/PyPDF2:\u003c= 1.27.8.

GHSA-jrm6-h9cq-8gqwMediumCVSS 6.2

PyPDF2 quadratic runtime with malformed PDF missing xref marker

Vendor

GitHub Security Advisories

Published

June 30, 2023

Last Modified

November 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-36810 →

📋 Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.

Patches

https://github.com/py-pdf/pypdf/pull/808

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

PyPDF2 PR #808
PyPDF2 Issue #582

🎯 Affected products1

pip/PyPDF2:<= 1.27.8

🔗 References (7)

https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
https://nvd.nist.gov/vuln/detail/CVE-2023-36810
https://github.com/py-pdf/pypdf/issues/582
https://github.com/py-pdf/pypdf/pull/808
https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373
https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html
https://github.com/advisories/GHSA-jrm6-h9cq-8gqw