Deserialization Of Untrusted Data

pyarrow is vulnerable to Deserialization Of Untrusted Data. The vulnerability due to the Arrow IPC, Feather or Parquet data from untrusted sources as the library does not by default disable the PyExtensionType autoloading. This allows an attacker to create PyArrow-specific extension types which...

GHSA-5WVP-7F3H-6WMM PyArrow: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

PyArrow: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

a2ml (>=0.4.0, <=1.0.55), abi-ds-utils (>=0.1.2, <=1.2.1) +1146 more potentially affected by CVE-2023-47248 via pyarrow (>=0.14.0, <=14.0.0)

pyarrow PYPI version =0.14.0, =0.4.0, =0.1.2, =0.1.1, =2.0.4, =0.0.0.dev0, =4.2.0, =0.3.0, =0.0.1a1, =0.1.0, =0.0.53, =0.1.0, =2.1.0, =7.1.5 - airbyte-cdk 0.45.0 and more Source cves: CVE-2023-47248 Source advisory: GHSA-5WVP-7F3H-6WMM...

a2ml (>=0.4.0, <=1.0.55), abi-ds-utils (>=0.1.2, <=1.2.1) +1146 more potentially affected by CVE-2023-47248 via pyarrow (>=0.14.0, <=14.0.0)

pyarrow PYPI version =0.14.0, =0.4.0, =0.1.2, =0.1.1, =2.0.4, =0.0.0.dev0, =4.2.0, =0.3.0, =0.0.1a1, =0.1.0, =0.0.53, =0.1.0, =2.1.0, =7.1.5 - airbyte-cdk 0.45.0 and more Source cves: CVE-2023-47248 Source advisory: OSV:GHSA-5WVP-7F3H-6WMM...

CVE-2023-47248

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

Deserialization of untrusted data

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

CVE-2023-47248

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

CVE-2023-47248 PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

CVE-2023-47248

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

a2ml (>=0.4.0, <=1.0.55), abi-ds-utils (>=0.1.2, <=1.2.1) +1146 more potentially affected by CVE-2023-47248 via pyarrow (>=0.14.0, <=14.0.0)

pyarrow PYPI version =0.14.0, =0.4.0, =0.1.2, =0.1.1, =2.0.4, =0.0.0.dev0, =4.2.0, =0.3.0, =0.0.1a1, =0.1.0, =0.0.53, =0.1.0, =2.1.0, =7.1.5 - airbyte-cdk 0.45.0 and more Source cves: CVE-2023-47248 Source advisory: MEND:CVE-2023-47248...

CVE-2023-47248

CVE-2023-47248 affects PyArrow IPC/Parquet readers (versions 0.14.0–14.0.0); unsafe deserialization allows arbitrary code execution when processing untrusted Arrow IPC/Feather/Parquet data. The NVD entry and multiple vendor advisories (IBM, CIRCL, Nuclei template) confirm remote code execution vi...

CVE-2023-47248 PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

CVE-2023-47248: Deserialization of Untrusted Data

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

PT-2023-7023

Name of the Vulnerable Software and Affected Versions PyArrow versions 0.14.0 through 14.0.0 Description The issue is related to the deserialization of untrusted data in IPC and Parquet readers, allowing arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather, or...

apache-beam (>=2.13.0, <=2.16.0), azureml-designer-classic-modules (0.0.112) +35 more potentially affected by CVE-2019-12410 via pyarrow (>=0.12.0, <=0.15.0)

pyarrow PYPI version =0.12.0, =2.13.0, =1.0.48.1, =1.0.4, =0.1.0, =1.4.2, =3.0.20190405035157, =3.1.20200301311111 - descarteslabs 1.0.0 and more Source cves: CVE-2019-12410 Source advisory: GHSA-CJW4-2W9R-R8MV...

apache-beam (>=2.13.0, <=2.16.0), azureml-designer-classic-modules (0.0.112) +35 more potentially affected by CVE-2019-12410 via pyarrow (>=0.12.0, <=0.15.0)

pyarrow PYPI version =0.12.0, =2.13.0, =1.0.48.1, =1.0.4, =0.1.0, =1.4.2, =3.0.20190405035157, =3.1.20200301311111 - descarteslabs 1.0.0 and more Source cves: CVE-2019-12410 Source advisory: OSV:GHSA-CJW4-2W9R-R8MV...

apache-beam (>=2.14.0, <=2.16.0), beneath (>=1.0.4, <=1.0.5) +12 more potentially affected by CVE-2019-12408 via pyarrow (>=0.14.0, <=0.15.0)

pyarrow PYPI version =0.14.0, =2.14.0, =1.0.4, =1.4.2, =0.1.1, =1.7.3, =0.4.5, =0.20.0, =2019.10.0, =0.1.1, =0.22.0, =0.24.1 - pyomnisci 25.0.0rc1 Source cves: CVE-2019-12408 Source advisory: GHSA-8CW2-JV5C-C825...

apache-beam (>=2.14.0, <=2.16.0), beneath (>=1.0.4, <=1.0.5) +12 more potentially affected by CVE-2019-12408 via pyarrow (>=0.14.0, <=0.15.0)

pyarrow PYPI version =0.14.0, =2.14.0, =1.0.4, =1.4.2, =0.1.1, =1.7.3, =0.4.5, =0.20.0, =2019.10.0, =0.1.1, =0.22.0, =0.24.1 - pyomnisci 25.0.0rc1 Source cves: CVE-2019-12408 Source advisory: OSV:GHSA-8CW2-JV5C-C825...

apache-beam (>=2.13.0, <=2.16.0), azureml-designer-classic-modules (0.0.112) +32 more potentially affected by CVE-2019-12410 via pyarrow (>=0.12.0, <=0.14.1)

pyarrow PYPI version =0.12.0, =2.13.0, =1.0.48.1, =1.0.4, =0.1.0, =1.4.2, =3.0.20190405035157, =0.1.0, =0.11.3 and more Source cves: CVE-2019-12410 Source advisory: OSV:PYSEC-2019-196...