Arbitrary Code Execution in PyArrow Deserialization
Summary
CVE-2023-47248: Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. Affects pyarrow versions >= 0.14.0, < 14.0.1. Fixed in 14.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyArrow is a Python library that provides a Pythonic API for interacting with Apache Arrow, a columnar in-memory data format. It allows users to read and write Arrow IPC, Feather, and Parquet data. PyArrow versions 0.14.0 to 14.0.0 are affected by a vulnerability that allows arbitrary code execution when deserializing untrusted data in IPC and Parquet readers.
Vulnerability Detail
The vulnerability arises when an application reads Arrow IPC, Feather, or Parquet data from untrusted sources, such as user-supplied input files. This can lead to the execution of arbitrary code, posing a significant security risk. The issue was identified in PyArrow versions 0.14.0 to 14.0.0.
How To Fix
Minimum fixed version
14.0.1
This is the first release that contains the fix.
pip install --upgrade "pyarrow==14.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update PyArrow to the fixed version to address the issue.
Conclusion
The arbitrary code execution vulnerability in PyArrow versions 0.14.0 to 14.0.0 poses a significant security risk. It is crucial to update PyArrow to version 14.0.1 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyarrow →
FAQ
PyArrow is a Python library that provides a Pythonic API for interacting with Apache Arrow, a columnar in-memory data format. It enables efficient data interchange between different systems and languages.
PyArrow versions 0.14.0 to 14.0.0 are affected by this vulnerability. It is recommended to upgrade to version 14.0.1 or later.
The vulnerability allows arbitrary code execution when deserializing untrusted data in IPC and Parquet readers. If an application reads Arrow IPC, Feather, or Parquet data from untrusted sources, it can be exploited to execute malicious code.
No, there are no known workarounds for this vulnerability. Updating PyArrow to the fixed version is the recommended solution.
You can find more information about this vulnerability in the PyPA Advisory Database: https://github.com/pypa/advisory-database/blob/main/vulns/pyarrow/PYSEC-2023-238.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pyarrow.
