CVE-2022-24859

Name	CVE-2022-24859
Description	PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3039-1, DLA-3451-1
Debian Bugs	1009879

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pypdf2 (PTS)	jessie	1.23+git20141008-1+deb8u1	vulnerable
	stretch (security)	1.26.0-2+deb9u1	fixed
	stretch (lts), stretch	1.26.0-2+deb9u2	fixed
	buster (security), buster, buster (lts)	1.26.0-2+deb10u2	fixed
	bullseye	1.26.0-4+deb11u1	fixed
	bookworm	2.12.1-3+deb12u1	fixed
	sid	2.12.1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pypdf2	source	jessie	(unfixed)	end-of-life
pypdf2	source	stretch	1.26.0-2+deb9u1		DLA-3039-1
pypdf2	source	buster	1.26.0-2+deb10u1		DLA-3451-1
pypdf2	source	bullseye	1.26.0-4+deb11u1
pypdf2	source	(unstable)	1.27.9-1			1009879

Notes

https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79
https://github.com/py-pdf/PyPDF2/issues/329
https://github.com/py-pdf/PyPDF2/pull/740