CVE-2019-12408: PYSEC-2019-195 - It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had

CVE-2019-12408 · Severity: low · CVSS 3.1 · Published 2019-11-08

Technologies: pyarrow (PyPI). Vendors: RubyGems, PyPI.

Executive brief

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Affected products

RubyGems red-arrow
PyPI pyarrow

Related threats

Apache Arrow C++ use-after-free in IPC file reader
PYSEC-2024-161 - Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary co
PYSEC-2023-238 - Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An applic
PYSEC-2019-196 - While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left