Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows
    arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from
    untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not
    other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1.
    Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow
    14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be
    available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that
    disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for
    instructions. (CVE-2023-47248)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c907492c3e advisory.

    Update to latest version; fix CVE-2023-47248


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1c5e667fd0 advisory.

    Update to latest version; fix CVE-2023-47248


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8857bdcd95 advisory.

    Update to latest version; fix CVE-2023-47248


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
411064	SCA: security update for pyarrow (GHSA-5wvp-7f3h-6wmm)	Tenable Cloud Security	SCA Checks	Local	critical
411064	SCA: security update for pyarrow (GHSA-5wvp-7f3h-6wmm)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
186389	Fedora 38 : python-geopandas (2023-c907492c3e)	Nessus	Fedora Local Security Checks	Local	critical
186388	Fedora 39 : python-geopandas (2023-1c5e667fd0)	Nessus	Fedora Local Security Checks	Local	critical
186387	Fedora 37 : python-geopandas (2023-8857bdcd95)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2023-47248

critical

Tenable Plugins

critical

critical

critical

critical

critical