An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF.
The issue was fixed with https://github.com/py-pdf/pypdf/pull/1331
If you cannot update your version of PyPDF2
(preferably to pypdf>3.1.0
as PyPDF2 is deprecated), you should modify PyPDF2/generic/_data_structures.py::read_object
.
Replace:
else:
# number object OR indirect reference
peek = stream.read(20)
stream.seek(-len(peek), 1) # reset to start
if IndirectPattern.match(peek) is not None:
return IndirectObject.read_from_stream(stream, pdf)
else:
return NumberObject.read_from_stream(stream)
by
elif tok in b"0123456789+-.":
# number object OR indirect reference
peek = stream.read(20)
stream.seek(-len(peek), 1) # reset to start
if IndirectPattern.match(peek) is not None:
return IndirectObject.read_from_stream(stream, pdf)
else:
return NumberObject.read_from_stream(stream)
else:
raise PdfReadError(
f"Invalid Elementary Object starting with {tok} @{stream.tell()}"
)
{ "nvd_published_at": "2023-06-30T19:15:09Z", "cwe_ids": [ "CWE-835" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-06-30T22:19:39Z" }