Description
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Arrow | Apache Arrow 0.12.0 to 0.14.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pyarrow | >= 0.12.0, < 0.15.0 | 0.15.0 | PYSEC-2019-196 |
| PyPI | pyarrow | >= 0.12.0, < 0.15.1 | 0.15.1 | GHSA-cjw4-2w9r-r8mv |
| RubyGems | red-arrow | >= 0.12.0, < 0.15.1 | 0.15.1 | GHSA-cjw4-2w9r-r8mv |
References
- [arrow-dev] 20191108 [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1 mailing-list
- [oss-security] 20191107 [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1 mailing-list
- [announce] 20191108 [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1 mailing-list