Published: 09/11/2023 Updated: 29/11/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See pypi.org/project/pyarrow-hotfix/ for instructions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache pyarrow

import numpy as np import pandas as pd df_train = pdread_csv('/Users/linhnguyen/Downloads/store-sales-time-series-forecasting/traincsv') df_test = pdread_csv('/Users/linhnguyen/Downloads/store-sales-time-series-forecasting/testcsv') df_stores = pdread_csv('/Users/linhnguyen/Downloads/store-sales-time-series-fo

Predicting Bank Churn with CatBoost Model Author: Linh Nguyen Project Overview In this project, I aim to predict bank customer churn using advanced machine learning techniques, particularly leveraging the CatBoostClassifier Customer churn, or the rate at which customers leave a service, is a critical concern for businesses, especially in the banking sector Identifying and und

PyArrow Hotfix Description This is a hotfix for the PyArrow security vulnerability CVE-2023-47248 We generally recommend upgrading to PyArrow 1401 or later, but if you cannot upgrade, this package disables the vulnerability on older versions Installation Use pip to install: pip install pyarrow_hotfix Note Both pyarrow-hotfix a

CWE-502 https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf https://pypi.org/project/pyarrow-hotfix/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/https://nvd.nist.gov https://github.com/linhkolor/SalesPrediction_LightGBM

CVE-2023-47248

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect