Log in Start free

Vulnerability · Published Nov 9, 2023 · Assigned by apache

CVE-2023-47248PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

Critical 9.8

In plain English

A critical-severity unsafe deserialization in PyArrow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 14.5% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)14.5%top 3.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC

Official description

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIpyarrow14.0.1GHSA-5wvp-7f3h-6wmm
PyPIpyarrow14.0.1PYSEC-2023-238

Affected products (as reported)

VendorProductVersions
Apache Software Foundation PyArrow 0.14.0 – through 14.0.0
Apache Software Foundation PyArrow 0.14.0 – through 14.0.0

Weakness: CWE-502

References