Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-47248US | critical9.8 | Exploit | ||
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IP… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-5wvp-7f3h-6wmmADVISORY
- https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecfFIX
- https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7nWEB
- https://pypi.org/project/pyarrow-hotfix/FIX
- https://www.cve.org/CVERecord?id=CVE-2023-47248ADVISORY
- https://www.openwall.com/lists/oss-security/2023/11/08/7WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan