Vulnerability in Py-Pdf Pypdf
CVE-2023-36810
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Py-Pdf Pypdf — versions < 1.27.9
- Pypdf Project
Weakness classification (CWE)
References
- github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw (Exploit, Patch, Vendor Advisory)
- github.com/py-pdf/pypdf/issues/582 (Exploit, Issue Tracking, Vendor Advisory)
- github.com/py-pdf/pypdf/pull/808 (Patch)
- lists.debian.org/debian-lts-announce/2023/07/msg00019.html
Frequently asked questions
- What is CVE-2023-36810?
- CVE-2023-36810 is a medium-severity vulnerability in Py-Pdf Pypdf, classified under Inefficient Algorithmic Complexity. CVSS score: 6.2/10. Published 2023-06-30.
- How severe is CVE-2023-36810?
- Medium severity. CVSS v3 base score is 6.2 out of 10.