PT-2023-7023 · Apache · Pyarrow

Antoine Pitrou · Published 2023-11-08 · Updated 2026-05-13 · CVE-2023-47248

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PyArrow versions 0.14.0 through 14.0.0

Description The issue is related to the deserialization of untrusted data in IPC and Parquet readers, allowing arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather, or Parquet data from untrusted sources, such as user-supplied input files. This vulnerability only affects PyArrow and not other Apache Arrow implementations or bindings.

Recommendations For PyArrow versions 0.14.0 through 14.0.0, it is recommended to upgrade to version 14.0.1 or later. Downstream libraries should also upgrade their dependency requirements to PyArrow 14.0.1 or later. If an upgrade is not possible, a separate package pyarrow-hotfix is available to disable the vulnerability on older PyArrow versions.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-08044

CVE-2023-47248

GHSA-5WVP-7F3H-6WMM

OPENSUSE-SU-2024:13431-1

OPENSUSE-SU-2024:13460-1

OPENSUSE-SU-2024:13480-1

PYSEC-2023-238

Affected Products

Pyarrow

References · 28

• https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf · Patch
• https://osv.dev/vulnerability/PYSEC-2023-238 · Vendor Advisory
• https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47248 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-47248 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47248 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-47248 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08044 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wvp-7f3h-6wmm · Vendor Advisory
• https://github.com/apache/arrow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2023-238.yaml · Note
• https://twitter.com/fletch_ai/status/1722828191557980407 · Twitter Post