CVE-2023-47248 : Security Advisory and Response

A critical vulnerability has been identified in PyArrow versions 0.14.0 to 14.0.0 that allows arbitrary code execution when deserializing untrusted data in IPC and Parquet readers. This CVE impacts applications that read Arrow IPC, Feather, or Parquet data from untrusted sources.

Understanding CVE-2023-47248

This vulnerability, also known as "PyArrow: Arbitrary code execution when loading a malicious data file," presents a significant risk to systems using PyArrow.

What is CVE-2023-47248?

The CVE-2023-47248 vulnerability in PyArrow versions 0.14.0 to 14.0.0 allows attackers to execute arbitrary code by exploiting the deserialization of untrusted data in IPC and Parquet readers.

The Impact of CVE-2023-47248

The impact of this vulnerability is severe as it enables attackers to execute arbitrary code, compromising the integrity and security of the affected systems.

Technical Details of CVE-2023-47248

PyArrow versions 0.14.0 to 14.0.0 are affected by this vulnerability, specifically in the IPC and Parquet readers. It is crucial to take immediate action to prevent exploitation.

Vulnerability Description

The vulnerability arises from deserializing untrusted data in IPC and Parquet readers, allowing attackers to execute arbitrary code.

Affected Systems and Versions

PyArrow versions 0.14.0 to 14.0.0 are affected by this vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by manipulating IPC and Parquet data from untrusted sources, leading to arbitrary code execution.

Mitigation and Prevention

It is essential to take immediate steps to secure systems and prevent the exploitation of CVE-2023-47248.

Immediate Steps to Take

Users of PyArrow are strongly advised to upgrade to version 14.0.1 to mitigate this vulnerability. Downstream libraries should also update their dependency requirements accordingly.

Long-Term Security Practices

Implementing secure coding practices and regularly updating software dependencies are crucial for maintaining a secure environment.

Patching and Updates

PyPI packages are available for PyArrow 14.0.1, while conda-forge packages are expected to be released soon. Alternatively, users can utilize the

pyarrow-hotfix

package to address the vulnerability on older PyArrow versions.