Deserialization in Apache Pyarrow
CVE-2023-47248
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
Vulnerability class: Insecure Deserialization
EPSS: 0.144 (96.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Pyarrow
- Apache Software Foundation Pyarrow — versions 0.14.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List, Third Party Advisory)
- security@apache.org (Patch, patch)
- security@apache.org (Product, mitigation)
- security@apache.org
- security@apache.org
- security@apache.org
Frequently asked questions
- What is CVE-2023-47248?
- CVE-2023-47248 is a critical-severity vulnerability in Apache Pyarrow, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2023-11-09.
- How severe is CVE-2023-47248?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-47248 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.