PyPI/pyarrow CVE-2023-47248: unknown, EPSS 14.53%

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parque

Action: Upgrade pyarrow to 14.0.1 or later.

pip install pyarrow==14.0.1

Affected

Fixed versions

Sources

• osv: PYSEC-2023-238
• https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
• https://www.openwall.com/lists/oss-security/2023/11/08/7
• https://github.com/advisories/GHSA-5wvp-7f3h-6wmm
• https://www.cve.org/CVERecord?id=CVE-2023-47248
• https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf
• https://pypi.org/project/pyarrow-hotfix/

CVE-2023-47248 · published 2023-11-17T17:41:59Z · modified 2023-11-20T09:26:47.189113Z · JSON