{"action":"Upgrade pyarrow to 17.0.0 or later.","affected":[{"fixed":"17.0.0","introduced":"4.0.0"}],"component":"pyarrow","cve_ids":["CVE-2024-52338"],"ecosystem":"PyPI","epss":0.02326,"exploited":false,"fixed_versions":["17.0.0"],"id":"tcs_01M5KGM6REXNZNPB12QY840TKF","modified_at":"2025-01-14T05:57:19.017909Z","published_at":"2024-11-28T17:15:48Z","references":["https://osv.dev/vulnerability/PYSEC-2024-161","https://github.com/apache/arrow/commit/801de2fbcf5bcbce0c019ed4b35ff3fc863b141b","https://lists.apache.org/thread/0rcbvj1gdp15lvm23zm601tjpq0k25vt","http://www.openwall.com/lists/oss-security/2024/11/28/3"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-161","url":"https://osv.dev/vulnerability/PYSEC-2024-161"},{"source":"nvd","source_id":"CVE-2024-52338","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52338"}],"summary":"Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it"}