Russian Vulnerability Scanner Database

Back to List

CVE-2023-47248

Scores

EPSS

0.847high84.7%
0%20%40%60%80%100%

Percentile: 84.7%

CVSS

9.8critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).

This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.

It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.

If it is not possible to upgrade, we provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvd

CWEs

CWE-502

Related Vulnerabilities

BDU:2023-08044

Exploits

Exploit ID: CVE-2023-47248

Source: github-poc

URL: https://github.com/Prodigysec/pyarrow-CVE-2023-47248

Vulnerable Software (2)

Type: Configuration

Product: apache-arrow

Operating System: debian

Trait: 
{  "unaffected": true}

Source: debian

Type: Configuration

Vendor: *

Product: pyarrow

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:apache:pyarrow:*:*:*:*:*:*:*:*",      "versionEndIncluding": "14.0.0",      "versionStartIncluding": "0.14.0",      "vulnerable": true    }  ...

Source: nvd

End of list