pypdf: Possible long runtimes with large amount of embedded files

[ Description ]Official description

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.

[ Fixes ]Fixes and patches

• pypdf 6.19.0Fixed version · GitHub Advisories · pip package pypdf: upgrade to 6.19.0 or later (affected < 6.19.0)
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Packages ]Affected open-source packages

• pypdf pipAffected < 6.19.0 · fixed in 6.19.0 · GHSA-v247-6f48-mgcj

[ References ]References

• github.com/py-pdf/pypdf/commit/6b10556d13609a68f9ed18bb29fdd8bba88eb2c3Patch
• github.com/py-pdf/pypdf/pull/4081PatchIssue Tracking
• github.com/py-pdf/pypdf/releases/tag/6.19.0Release Notes
• github.com/py-pdf/pypdf/security/advisories/GHSA-v247-6f48-mgcjVendor Advisory