CVE-2023-47248: PyArrow Arbitrary Code Execution Vulnerability
Summary
CVE-2023-47248: PyArrow: Arbitrary code execution when loading a malicious data file. Affects pyarrow versions >= 0.14.0, < 14.0.1. Fixed in 14.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyArrow is an open-source library that provides a Python interface for Apache Arrow, a columnar in-memory data format. It allows users to efficiently transfer data between different programming languages and systems. PyArrow is commonly used in data processing and analytics applications. However, versions 0.14.0 to 14.0.0 of PyArrow are vulnerable to arbitrary code execution when loading a malicious data file. This vulnerability can be exploited if an application reads Arrow IPC, Feather, or Parquet data from untrusted sources.
Vulnerability Detail
The vulnerability in PyArrow arises from the deserialization of untrusted data in IPC and Parquet readers. An attacker can craft a malicious data file that, when loaded by a vulnerable application, triggers arbitrary code execution. This can lead to various security risks, including remote code execution, data exfiltration, and privilege escalation. It is important to note that this vulnerability only affects PyArrow and not other Apache Arrow implementations or bindings.
How To Fix
Minimum fixed version
14.0.1
This is the first release that contains the fix.
pip install --upgrade "pyarrow==14.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The PyArrow Arbitrary Code Execution vulnerability (CVE-2023-47248) poses a significant risk to applications that read Arrow IPC, Feather, or Parquet data from untrusted sources. It is crucial to upgrade to PyArrow 14.0.1 or later to mitigate this vulnerability. If upgrading is not feasible, the 'pyarrow-hotfix' package can be used as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyarrow →
FAQ
PyArrow is an open-source library that provides a Python interface for Apache Arrow, a columnar in-memory data format. It enables efficient data transfer between different programming languages and systems.
Versions 0.14.0 to 14.0.0 of PyArrow are affected by this vulnerability.
This vulnerability allows arbitrary code execution, which can lead to remote code execution, data exfiltration, and privilege escalation.
No, this vulnerability only affects PyArrow and not other Apache Arrow implementations or bindings.
To fix this vulnerability, upgrade to PyArrow 14.0.1 or later. If upgrading is not possible, use the 'pyarrow-hotfix' package provided by the maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for pyarrow.
