Nixpkgs security tracker
by @mweinelt Activity log
- Created suggestion
-
@mweinelt
ignored
10 packages
- capypdf
- python312Packages.pypdf2
- python312Packages.pypdf3
- python313Packages.pypdf2
- python313Packages.pypdf3
- python314Packages.pypdf2
- python314Packages.pypdf3
- python312Packages.pypdfium2
- python313Packages.pypdfium2
- python314Packages.pypdfium2
- @mweinelt accepted
- @mweinelt published on GitHub
pypdf: manipulated stream length values can exhaust RAM
pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.
References
-
https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7 x_refsource_CONFIRM
-
https://github.com/py-pdf/pypdf/pull/3675 x_refsource_MISC
-
https://github.com/py-pdf/pypdf/releases/tag/6.8.0 x_refsource_MISC
Affected products
- ==< 6.8.0
Matching in nixpkgs
pkgs.python312Packages.pypdf
None
pkgs.python313Packages.pypdf
Pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
pkgs.python314Packages.pypdf
Pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
Ignored packages (10)
pkgs.capypdf
Fully color managed PDF generation library
pkgs.python312Packages.pypdf2
None
pkgs.python312Packages.pypdf3
None
pkgs.python313Packages.pypdf2
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf2-3.0.1
- nixpkgs-unstable pypdf2-3.0.1
- nixos-unstable-small pypdf2-3.0.1
pkgs.python313Packages.pypdf3
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf3-1.0.6
- nixpkgs-unstable pypdf3-1.0.6
- nixos-unstable-small pypdf3-1.0.6
pkgs.python314Packages.pypdf2
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf2-3.0.1
- nixpkgs-unstable pypdf2-3.0.1
- nixos-unstable-small pypdf2-3.0.1
pkgs.python314Packages.pypdf3
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf3-1.0.6
- nixpkgs-unstable pypdf3-1.0.6
- nixos-unstable-small pypdf3-1.0.6
pkgs.python312Packages.pypdfium2
None
pkgs.python313Packages.pypdfium2
Python bindings to PDFium
-
nixos-unstable pypdfium2-5.5.0
- nixpkgs-unstable pypdfium2-5.5.0
- nixos-unstable-small pypdfium2-5.5.0
pkgs.python314Packages.pypdfium2
Python bindings to PDFium
-
nixos-unstable pypdfium2-5.5.0
- nixpkgs-unstable pypdfium2-5.5.0
- nixos-unstable-small pypdfium2-5.5.0
Package maintainers
-
@javaes Jan van Esdonk <jan+dev@vanesdonk.de>