Update dependency PyPDF2 to v1.27.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
PyPDF2 (changelog)	==1.26.0 → ==1.27.5

---

Manipulated inline images can cause Infinite Loop in PyPDF2

CVE-2022-24859 / GHSA-xcjx-m2pj-8g79

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code:

from PyPDF2 import PdfFileReader, PdfFileWriter
from PyPDF2.pdf import ContentStream

reader = PdfFileReader("malicious.pdf", strict=False)
for page in reader.pages:
    ContentStream(page.getContents(), reader)

Patches

PyPDF2==1.27.5 and later are patched.

Credits to Sebastian Krause for finding (issue) and fixing (PR) it.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79
• https://nvd.nist.gov/vuln/detail/CVE-2022-24859
• https://github.com/py-pdf/PyPDF2/issues/329
• https://github.com/py-pdf/PyPDF2/pull/740
• https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5
• https://github.com/pypa/advisory-database/tree/main/vulns/pypdf2/PYSEC-2022-194.yaml
• https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html
• https://lists.debian.org/debian-lts-announce/2023/06/msg00013.html
• https://github.com/advisories/GHSA-xcjx-m2pj-8g79

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

py-pdf/PyPDF2 (PyPDF2)

v1.27.5: Version 1.27.5, 2022-04-15

Compare Source

Security (SEC)

• ContentStream_readInlineImage had potential infinite loop (#​740)

Bug fixes (BUG)

• Fix merging encrypted files (#​757)
• CCITTFaxDecode decodeParms can be an ArrayObject (#​756)

Robustness improvements (ROBUST)

• title sometimes None (#​744)

Documentation (DOC)

• Adjust short description of the package

Tests and Test setup (TST)

• Rewrite JS tests from unittest to pytest (#​746)
• Increase Test coverage, mainly with filters (#​756)
• Add test for inline images (#​758)

Developer Experience Improvements (DEV)

• Remove unused Travis-CI configuration (#​747)
• Show code coverage (#​754, #​755)
• Add mutmut (#​760)

Miscellaneous

• STY: Closing file handles, explicit exports, ... (#​743)

All changes: py-pdf/pypdf@1.27.4...1.27.5

v1.27.4

Compare Source

v1.27.3

Compare Source

v1.27.2

Compare Source

v1.27.1

Compare Source

v1.27.0: Version 1.27.0

Compare Source

Features

• Add alpha channel support for png files in Script (#​614)

Bug fixes (BUG)

• Fix formatWarning for filename without slash (#​612)
• Add whitespace between words for extractText() (#​569, #​334)
• "invalid escape sequence" SyntaxError (#​522)
• Avoid error when printing warning in pythonw (#​486)
• Stream operations can be List or Dict (#​665)

Documentation (DOC)

• Added Scripts/pdf-image-extractor.py
• Documentation improvements (#​550, #​538, #​324, #​426, #​394)

Tests and Test setup (TST)

• Add Github Action which automatically run unit tests via pytest and
  static code analysis with Flake8 (#​660)
• Add several unit tests (#​661, #​663)
• Add .coveragerc to create coverage reports

Developer Experience Improvements (DEV)

• Pre commit: Developers can now pre-commit install to avoid tiny issues
  like trailing whitespaces

Miscallenious

• Add the LICENSE file to the distributed packages (#​288)
• Use setuptools instead of distutils (#​599)
• Improvements for the PyPI page (#​644)
• Python 3 changes (#​504, #​366)

You can see the full changelog at: py-pdf/pypdf@1.26.0...1.27.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.