CVE-2019-12410 (High) detected in arrow-0.13.1-py2.py3-none-any.whl

[mend-bolt-for-github]

CVE-2019-12410 - High Severity Vulnerability

Vulnerable Library - arrow-0.13.1-py2.py3-none-any.whl

Better dates & times for Python

Library home page: https://files.pythonhosted.org/packages/f4/7f/0360628ba40bb93c10cd89cd289b6a8e9ea87b2db884b8edf32c80ee1c73/arrow-0.13.1-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ arrow-0.13.1-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: a4002b7501d139ec7ca5ecd111f774e1bbbe4daf

Found in base branch: master

Vulnerability Details

While investigating UBSAN errors in apache/arrow#5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Publish Date: 2019-11-08

URL: CVE-2019-12410

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cjw4-2w9r-r8mv

Release Date: 2019-11-08

Fix Resolution: 0.15.1

---

Step up your Open Source Security Game with Mend here