CVE-2023-24808 Denial Of Service when opening a corrupt PDF file in pdfio
Attackers can cause a denial of service by uploading crafted PDF files to applications using the pdfio library, leading to infinite loops and resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-24808?
CVE-2023-24808 is a medium-severity denial of service vulnerability in michaelrsweet pdfio, published on 7 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-835
Which versions are affected by CVE-2023-24808?
It affects 1 product.
Products include Pdfio Project Pdfio.
How do I fix CVE-2023-24808?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-24808 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24808 exists.
Other vulnerabilities in michaelrsweet pdfio
Sources
Also known as DEBIAN-CVE-2023-24808, GHSA-cjc4-x96x-fvgf, UBUNTU-CVE-2023-24808.