CVE-2022-24859: Manipulated inline images can cause Infinite Loop in PyPDF2

CVE-2022-24859 · Severity: low · CVSS 3.1 · Published 2022-04-18

PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.

Technologies: pypdf2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-24859 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-24859 being exploited in the wild.
How severe is CVE-2022-24859?
Low severity, with a CVSS score of 3.1, published 18 April 2022.
Which products and versions are affected?
pypdf2 (PyPI) ECOSYSTEM:introduced=0,fixed=1.27.5.
Is there a fix for CVE-2022-24859?
Yes. pypdf2 (PyPI): upgrade to 1.27.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2022-24859?
Check whether you run pypdf2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pypdf2 (PyPI): upgrade to 1.27.5 or later
    pip install "pypdf2>=1.27.5"

Affected products

  • pypdf2 (PyPI) ECOSYSTEM:introduced=0,fixed=1.27.5

Identifiers

  • CVE-2022-24859
  • GHSA-xcjx-m2pj-8g79
  • PYSEC-2022-194

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.