CVE-2019-12410: PYSEC-2019-196 - While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left

CVE-2019-12410 · Severity: low · CVSS 3.1 · Published 2019-11-08

Technologies: pyarrow (PyPI). Vendors: RubyGems, PyPI.

Executive brief

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Affected products

RubyGems red-arrow
PyPI pyarrow

Related threats

Apache Arrow C++ use-after-free in IPC file reader
PYSEC-2024-161 - Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary co
PYSEC-2023-238 - Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An applic
PYSEC-2019-195 - It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had