CVE-2023-47248
2 advisories.
PyPI/pyarrow CVE-2023-47248: critical 9.8
PyArrow: Arbitrary code execution when loading a malicious data file
Action: Upgrade pyarrow to 14.0.1 or later.
pip install pyarrow==14.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.14.0 | 14.0.1 | - |
Fixed versions
| 14.0.1 |
Sources
- osv: GHSA-5wvp-7f3h-6wmm
- https://nvd.nist.gov/vuln/detail/CVE-2023-47248
- https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf
- https://github.com/advisories/GHSA-5wvp-7f3h-6wmm
- https://github.com/apache/arrow
- https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2023-238.yaml
- https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL
- https://pypi.org/project/pyarrow-hotfix
- https://www.cve.org/CVERecord?id=CVE-2023-47248
- https://www.openwall.com/lists/oss-security/2023/11/08/7
CVE-2023-47248 · published · modified · JSON
PyPI/pyarrow CVE-2023-47248: unknown
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parque
Action: Upgrade pyarrow to 14.0.1 or later.
pip install pyarrow==14.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.14.0 | 14.0.1 | - |
Fixed versions
| 14.0.1 |
Sources
- osv: PYSEC-2023-238
- https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
- https://www.openwall.com/lists/oss-security/2023/11/08/7
- https://github.com/advisories/GHSA-5wvp-7f3h-6wmm
- https://www.cve.org/CVERecord?id=CVE-2023-47248
- https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf
- https://pypi.org/project/pyarrow-hotfix/
CVE-2023-47248 · published · modified · JSON