Описание
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.
A flaw was found in pypdf, a pure-python PDF library. A remote attacker could exploit this vulnerability by providing a specially crafted PDF file. When the library attempts to parse unusually large font /ToUnicode CMap streams during text extraction, it can lead to excessive memory consumption. This can result in a denial of service (DoS) for applications processing such malicious PDF files.
Отчет
A flaw in the pypdf library can lead to a denial of service due to uncontrolled resource consumption. Processing a specially crafted PDF file containing unusually large /ToUnicode streams can cause excessive memory allocation, impacting the availability of Red Hat products that rely on pypdf for PDF processing. This issue requires user interaction to trigger the vulnerable parsing.
Меры по смягчению последствий
To reduce exposure, avoid processing untrusted PDF files with applications that use the pypdf library. If processing untrusted content is necessary, deploy affected applications within a sandboxed environment to contain potential resource exhaustion.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Out of support scope | ||
| Lightspeed Core | lightspeed-core/lightspeed-stack-rhel9 | Fix deferred | ||
| Lightspeed Core | lightspeed-core/rag-tool-cpu-rhel9 | Fix deferred | ||
| Lightspeed Core | lightspeed-core/rag-tool-cuda-12.9-rhel9 | Fix deferred | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-ocp-rag-rhel9 | Fix deferred | ||
| OpenShift Lightspeed | openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-chatbot-rhel8 | Out of support scope | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-gaudi-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.
pypdf is a free and open-source pure-python PDF library. Prior to 6.15 ...
pypdf: Possible large memory usage for large /ToUnicode streams
EPSS
5.5 Medium
CVSS3