Nixpkgs security tracker
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
10 packages
- capypdf
- python312Packages.pypdf2
- python312Packages.pypdf3
- python313Packages.pypdf2
- python313Packages.pypdf3
- python314Packages.pypdf2
- python314Packages.pypdf3
- python312Packages.pypdfium2
- python313Packages.pypdfium2
- python314Packages.pypdfium2
- @LeSuisse accepted
- @LeSuisse published on GitHub
pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.
References
-
https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx x_refsource_CONFIRM
-
https://github.com/py-pdf/pypdf/pull/3724 x_refsource_MISC
Ignored references (1)
-
https://github.com/py-pdf/pypdf/releases/tag/6.10.0 x_refsource_MISC
Affected products
- ==< 6.10.0
Matching in nixpkgs
pkgs.python312Packages.pypdf
None
pkgs.python313Packages.pypdf
Pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
pkgs.python314Packages.pypdf
Pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
Ignored packages (10)
pkgs.capypdf
Fully color managed PDF generation library
pkgs.python312Packages.pypdf2
None
pkgs.python312Packages.pypdf3
None
pkgs.python313Packages.pypdf2
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf2-3.0.1
- nixpkgs-unstable pypdf2-3.0.1
- nixos-unstable-small pypdf2-3.0.1
pkgs.python313Packages.pypdf3
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf3-1.0.6
- nixpkgs-unstable pypdf3-1.0.6
- nixos-unstable-small pypdf3-1.0.6
pkgs.python314Packages.pypdf2
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf2-3.0.1
- nixpkgs-unstable pypdf2-3.0.1
- nixos-unstable-small pypdf2-3.0.1
pkgs.python314Packages.pypdf3
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf3-1.0.6
- nixpkgs-unstable pypdf3-1.0.6
- nixos-unstable-small pypdf3-1.0.6
pkgs.python312Packages.pypdfium2
None
pkgs.python313Packages.pypdfium2
Python bindings to PDFium
-
nixos-unstable pypdfium2-5.6.0
- nixpkgs-unstable pypdfium2-5.6.0
- nixos-unstable-small pypdfium2-5.6.0
pkgs.python314Packages.pypdfium2
Python bindings to PDFium
-
nixos-unstable pypdfium2-5.6.0
- nixpkgs-unstable pypdfium2-5.6.0
- nixos-unstable-small pypdfium2-5.6.0
Package maintainers
-
@javaes Jan van Esdonk <jan+dev@vanesdonk.de>