PT-2019-12790 · Apache · Apache Arrow

Published 2019-11-08 · Updated 2022-05-24 · CVE-2019-12408

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Arrow versions 0.14.0 through 0.14.1

Description A bug was found in the C++ implementation of Apache Arrow, which also affects the R, Python, and Ruby implementations. This bug occurs when building arrays with null values, resulting in an uninitialized memory issue. This can cause unintentional sharing of uninitialized memory if Arrow Arrays are transmitted or persisted in certain formats.

Recommendations For Apache Arrow versions 0.14.0 through 0.14.1, consider avoiding the transmission or persistence of Arrow Arrays with null values until a fix is available. As a temporary workaround, restrict the use of arrays with null values to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-909

Related Identifiers

CVE-2019-12408

GHSA-8CW2-JV5C-C825

PYSEC-2019-195

Affected Products

Apache Arrow

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/red-arrow/CVE-2019-12408.yml · Exploit
• https://osv.dev/vulnerability/CVE-2019-12408 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12408 · Security Note
• https://osv.dev/vulnerability/GHSA-8cw2-jv5c-c825 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2019-195.yaml · Note
• https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E · Note
• https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E · Note