CVE-2022-24859

描述

PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.

如何修補 CVE-2022-24859

要修補 CVE-2022-24859,請將受影響套件升級到下列已修補版本。

• —升級至 1.26.0-4+deb11u1 或更新版本
• —升級至 1.26.0-2+deb9u1 或更新版本
• —升級至 1.26.0-2+deb10u1 或更新版本
• —升級至 1.27.5 或更新版本
• —升級至 1.27.5 或更新版本

CVE-2022-24859 正在被利用嗎?

低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。

受影響套件(5)

• from 0, < 1.26.0-4+deb11u1
• from 0, < 1.26.0-2+deb9u1
• from 0, < 1.26.0-2+deb10u1
• from 0, < 1.27.5
• from 0, < 1.27.5

CVSS 分數

參考連結(10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-24859
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-24859
• PATCHgithub.com/py-pdf/PyPDF2
• WEBgithub.com/py-pdf/PyPDF2/issues/329
• WEBgithub.com/py-pdf/PyPDF2/pull/740