Vulnerability in Apache Arrow
CVE-2019-12410
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
EPSS: 0.046 (90.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Arrow
- Apache Software Foundation Arrow — versions Apache Arrow 0.12.0 to 0.14.1
Weakness classification (CWE)
References
- security@apache.org (mailing-list, x_refsource_CONFIRM, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2019-12410?
- CVE-2019-12410 is a high-severity vulnerability in Apache Arrow, classified under CWE-909. CVSS score: 7.5/10. Published 2019-11-08.
- How severe is CVE-2019-12410?
- High severity. CVSS v3 base score is 7.5 out of 10.