PyArrow: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, maintainers provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | pyarrow | >= 0.14.0, < 14.0.1 | 14.0.1 |
Referencias
- https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
- https://www.openwall.com/lists/oss-security/2023/11/08/7
- https://github.com/advisories/GHSA-5wvp-7f3h-6wmm
- https://www.cve.org/CVERecord?id=CVE-2023-47248
- https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf
- https://pypi.org/project/pyarrow-hotfix/
- https://nvd.nist.gov/vuln/detail/CVE-2023-47248
- https://github.com/apache/arrow
- https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2023-238.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL
- https://pypi.org/project/pyarrow-hotfix
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-502- Plataforma
- Python (PyPI)
- Paquete
pyarrow- Publicada
- 09.11.2023
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2023-238 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5wvp-7f3h-6wmm - CC BY 4.0
Historial de vulnerabilidades: pyarrow
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 5
- Primera → última
- 11.2019 02.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 3
- Sin evaluar 1
Divulgaciones por año
- 2019: 2
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 1
- 2024: 1
- 2025: 0
- 2026: 1
-
PyArrow: Arbitrary code execution when loading a malicious data file esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.