CVE-2024-52338
1 advisory.
PyPI/pyarrow CVE-2024-52338: critical 9.8, EPSS 2.31%
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it
Action: Upgrade pyarrow to 17.0.0 or later.
pip install pyarrow==17.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 17.0.0 | - |
Fixed versions
| 17.0.0 |
Sources
- osv: PYSEC-2024-161
- nvd: CVE-2024-52338
- https://github.com/apache/arrow/commit/801de2fbcf5bcbce0c019ed4b35ff3fc863b141b
- https://lists.apache.org/thread/0rcbvj1gdp15lvm23zm601tjpq0k25vt
- http://www.openwall.com/lists/oss-security/2024/11/28/3
CVE-2024-52338 · published · modified · JSON