CVE-2019-12410PYSEC-2019-196GHSA-CJW4-2W9R-R8MV
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.15.0, 0.15.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache Arrow
Apache Arrow 0.12.0 to 0.14.1
- pyarrowPyPI
From 0.12.0 · fixed in 0.15.0
- pyarrowPyPI
From 0.12.0 · fixed in 0.15.1
- red-arrowRubyGems
From 0.12.0 · fixed in 0.15.1