CVE-2023-47248: PYSEC-2023-238 - Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An applic

CVE-2023-47248 · Severity: low · CVSS 3.1 · Published 2023-11-17

Technologies: pyarrow (PyPI). Vendors: PyPI.

Executive brief

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).

Affected products

PyPI pyarrow

Related threats

Apache Arrow C++ use-after-free in IPC file reader
PYSEC-2024-161 - Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary co
PYSEC-2019-196 - While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left
PYSEC-2019-195 - It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had