CVE - CVE-2022-24859

CVE-ID
CVE-2022-24859	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79 URL:https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79 MISC:https://github.com/py-pdf/PyPDF2/issues/329 URL:https://github.com/py-pdf/PyPDF2/issues/329 MISC:https://github.com/py-pdf/PyPDF2/pull/740 URL:https://github.com/py-pdf/PyPDF2/pull/740 MISC:https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5 URL:https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5 MLIST:[debian-lts-announce] 20220603 [SECURITY] [DLA 3039-1] pypdf2 security update URL:https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html MLIST:[debian-lts-announce] 20230609 [SECURITY] [DLA 3451-1] pypdf2 security update URL:https://lists.debian.org/debian-lts-announce/2023/06/msg00013.html
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20220210	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220210)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)