CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
76.9%
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, we provide a separate package pyarrow-hotfix
that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf
lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
lists.fedoraproject.org/archives/list/[email protected]/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/
lists.fedoraproject.org/archives/list/[email protected]/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/
lists.fedoraproject.org/archives/list/[email protected]/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/
pypi.org/project/pyarrow-hotfix/