PT-2019-12791 · Apache · Apache Arrow

Publicado 2019-11-08 · Atualizado 2022-05-24 · CVE-2019-12410

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Arrow versions 0.12.0 through 0.14.1

Description The issue arises when reading RLE null data from parquet, resulting in uninitialized Array data being left in memory. This affects the C++, Python, Ruby, and R implementations of Apache Arrow. The uninitialized memory could potentially be shared if transmitted over the wire or persisted in streaming IPC and file formats.

Recommendations For Apache Arrow versions 0.12.0 through 0.14.1, update to a version that initializes memory properly when reading RLE null data from parquet to prevent potential data sharing issues.

Exploit

Correção

Enumeração de Fraquezas

CWE-909

Identificadores relacionados

CVE-2019-12410

GHSA-CJW4-2W9R-R8MV

PYSEC-2019-196

Produtos afetados

Apache Arrow

Referências · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/red-arrow/CVE-2019-12410.yml · Exploit
• https://github.com/apache/arrow · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2019-196.yaml · Nota
• https://osv.dev/vulnerability/GHSA-cjw4-2w9r-r8mv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12410 · Nota de Segurança
• https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E · Nota
• https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E · Nota
• https://github.com/advisories/GHSA-cjw4-2w9r-r8mv · Nota
• http://openwall.com/lists/oss-security/2019/11/08/1 · Nota
• https://osv.dev/vulnerability/CVE-2019-12410 · Aviso do Fabricante
• https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E · Nota
• https://osv.dev/vulnerability/PYSEC-2019-196 · Aviso do Fabricante
• https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073%40%3Cannounce.apache.org%3E · Nota