-
-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Latest data: Thu Nov 16 08:04:08 UTC 2023
- Loading branch information
github.actions
committed
Nov 16, 2023
1 parent
5334b6d
commit 585a273
Showing
10 changed files
with
319 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,171 @@ | ||
| [ | ||
| { | ||
| "package": { | ||
| "name": "pypdf2", | ||
| "version": "2.12.1", | ||
| "ecosystem": "PyPI", | ||
| "commit": "" | ||
| }, | ||
| "vulnerabilities": [ | ||
| { | ||
| "modified": "2023-11-11T05:19:21Z", | ||
| "published": "2023-06-30T20:33:57Z", | ||
| "schema_version": "1.6.0", | ||
| "id": "GHSA-4vvm-4w3v-6mr8", | ||
| "aliases": [ | ||
| "CVE-2023-36464" | ||
| ], | ||
| "summary": "pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character", | ||
| "details": "### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF.\n\nExample Code and a PDF that causes the issue:\n\n```python\nfrom pypdf import PdfReader\n\n# https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230627T201018Z&X-Amz-Expires=300&X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2&X-Amz-SignedHeaders=host&actor_id=1658117&key_id=0&repo_id=3119517&response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf&response-content-type=application%2Fpdf\nreader = PdfReader(\"MiFO_LFO_FEIS_NOA_Published.3.pdf\")\npage = reader.pages[0]\npage.extract_text()\n```\n\nThe issue was introduced with https://github.com/py-pdf/pypdf/pull/969\n\n### Patches\n\nThe issue was fixed with https://github.com/py-pdf/pypdf/pull/1828\n\n### Workarounds\n\nIt is recommended to upgrade to `pypdf>=3.9.0`. PyPDF2 users should migrate to pypdf.\n\nIf you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`:\n\n```\nOLD: while peek not in (b\"\\r\", b\"\\n\"):\nNEW: while peek not in (b\"\\r\", b\"\\n\", b\"\"):\n```", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "ecosystem": "PyPI", | ||
| "name": "pypdf", | ||
| "purl": "pkg:pypi/pypdf" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "3.1.0" | ||
| }, | ||
| { | ||
| "fixed": "3.9.0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "versions": [ | ||
| "3.1.0", | ||
| "3.2.0", | ||
| "3.2.1", | ||
| "3.3.0", | ||
| "3.4.0", | ||
| "3.4.1", | ||
| "3.5.0", | ||
| "3.5.1", | ||
| "3.5.2", | ||
| "3.6.0", | ||
| "3.7.0", | ||
| "3.7.1", | ||
| "3.8.0", | ||
| "3.8.1" | ||
| ], | ||
| "database_specific": { | ||
| "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-4vvm-4w3v-6mr8/GHSA-4vvm-4w3v-6mr8.json" | ||
| } | ||
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "PyPI", | ||
| "name": "pypdf2", | ||
| "purl": "pkg:pypi/pypdf2" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "2.2.0" | ||
| }, | ||
| { | ||
| "last_affected": "3.0.1" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "versions": [ | ||
| "2.10.0", | ||
| "2.10.1", | ||
| "2.10.2", | ||
| "2.10.3", | ||
| "2.10.4", | ||
| "2.10.5", | ||
| "2.10.6", | ||
| "2.10.7", | ||
| "2.10.8", | ||
| "2.10.9", | ||
| "2.11.0", | ||
| "2.11.1", | ||
| "2.11.2", | ||
| "2.12.0", | ||
| "2.12.1", | ||
| "2.2.0", | ||
| "2.2.1", | ||
| "2.3.0", | ||
| "2.3.1", | ||
| "2.4.0", | ||
| "2.4.1", | ||
| "2.4.2", | ||
| "2.5.0", | ||
| "2.6.0", | ||
| "2.7.0", | ||
| "2.8.0", | ||
| "2.8.1", | ||
| "2.9.0", | ||
| "3.0.0", | ||
| "3.0.1" | ||
| ], | ||
| "database_specific": { | ||
| "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-4vvm-4w3v-6mr8/GHSA-4vvm-4w3v-6mr8.json" | ||
| } | ||
| } | ||
| ], | ||
| "severity": [ | ||
| { | ||
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8" | ||
| }, | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36464" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/py-pdf/pypdf/pull/1828" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/py-pdf/pypdf/pull/969" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/py-pdf/pypdf/commit/b0e5c689df689ab173df84dacd77b6fc3c161932" | ||
| }, | ||
| { | ||
| "type": "PACKAGE", | ||
| "url": "https://github.com/py-pdf/pypdf" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/py-pdf/pypdf/releases/tag/3.9.0" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "cwe_ids": [ | ||
| "CWE-835" | ||
| ], | ||
| "github_reviewed": true, | ||
| "github_reviewed_at": "2023-06-30T20:33:57Z", | ||
| "nvd_published_at": "2023-06-27T22:15:11Z", | ||
| "severity": "MODERATE" | ||
| } | ||
| } | ||
| ], | ||
| "groups": [ | ||
| { | ||
| "ids": [ | ||
| "GHSA-4vvm-4w3v-6mr8" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.