PYSEC-2023-238
At a glance
- Published
- Updated
- CVE
- CVE-2023-47248
- Aliases
- GHSA-5wvp-7f3h-6wmm
Description
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
Affected packages
| Package | Versions |
|---|---|
| PyPI · pyarrow | introduced 0.14.0, fixed 14.0.1 |
References
- https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n WEB
- https://www.openwall.com/lists/oss-security/2023/11/08/7 WEB
- https://github.com/advisories/GHSA-5wvp-7f3h-6wmm ADVISORY
- https://www.cve.org/CVERecord?id=CVE-2023-47248 ADVISORY
- https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf FIX
- https://pypi.org/project/pyarrow-hotfix/ FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |