CVE-2023-47248

Summary

CVE-2023-47248 is a deserialization vulnerability affecting PyArrow versions 0.14.0 to 14.0.0, where untrusted data can lead to arbitrary code execution. This issue primarily impacts applications that read Arrow IPC, Feather, or Parquet data from untrusted sources. PyArrow is the only affected implementation of Apache Arrow, and users are advised to upgrade to version 14.0.1. Alternatively, a hotfix package `pyarrow-hotfix` is available to disable the vulnerability on older PyArrow versions. Upgrades and hotfixes can be implemented through PyPI or conda-forge packages.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.