Date: Thu, 7 Nov 2019 21:34:36 -0800 From: Micah Kornfield <emkornfield@...che.org> To: oss-security@...ts.openwall.com Cc: security@...che.org Subject: [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1 The Apache Arrow project would like to hereby disclose that our 0.15.1 release patches two uninitialized memory bugs (CVE-2019-12408 and CVE-2019-12410) in the the C++ implementation (which in turn can affect, Python, Ruby and R). In both cases there is a potential vulnerability where data in memory can be unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats. Neither bug affects data persisted to the Apache Parquet file format. The first issue (CVE-2019-12408) affected ArrayBuilder classes in 0.14.0 and 0.14.1 releases. In some cases arrays with null values could be built using uninitialized memory for their data segment. The second bug (CVE-2019-12410) affected Apache Arrow versions since at least 0.12.0. The bug left data read from Apache Parquet files with RLE null encoded data uninitialized. It is recommended that users upgrade to 0.15.1 as soon as possible and audit any data that has been persisted in the Arrow IPC format or the Arrow File Format.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.