[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAK7Z5T9-mgfJR-Bc=GsBb4MXihZAkARazkkyQXzefqwxVVopTA@mail.gmail.com>
Date: Thu, 7 Nov 2019 21:34:36 -0800
From: Micah Kornfield <emkornfield@...che.org>
To: oss-security@...ts.openwall.com
Cc: security@...che.org
Subject: [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities
fixed in Apache Arrow 0.15.1
The Apache Arrow project would like to hereby disclose that our 0.15.1
release patches two uninitialized memory bugs (CVE-2019-12408 and
CVE-2019-12410) in the the C++ implementation (which in turn can affect,
Python, Ruby and R). In both cases there is a potential vulnerability
where data in memory can be unintentionally shared if Arrow Arrays are
transmitted over the wire (for instance with Flight) or persisted in the
streaming IPC and file formats. Neither bug affects data persisted to the
Apache Parquet file format.
The first issue (CVE-2019-12408) affected ArrayBuilder classes in 0.14.0
and 0.14.1 releases. In some cases arrays with null values could be built
using uninitialized memory for their data segment.
The second bug (CVE-2019-12410) affected Apache Arrow versions since at
least 0.12.0. The bug left data read from Apache Parquet files with RLE
null encoded data uninitialized.
It is recommended that users upgrade to 0.15.1 as soon as possible and
audit any data that has been persisted in the Arrow IPC format or the Arrow
File Format.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
