GHSA-8cw2-jv5c-c825

Suggest an improvement
Source
https://github.com/advisories/GHSA-8cw2-jv5c-c825
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8cw2-jv5c-c825/GHSA-8cw2-jv5c-c825.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-8cw2-jv5c-c825
Aliases
Published
2022-05-24T17:00:40Z
Modified
2024-10-21T21:23:35.125872Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Missing Initialization of Resource in Apache Arrow
Details

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Database specific
{
    "nvd_published_at": "2019-11-08T19:15:00Z",
    "cwe_ids": [
        "CWE-909"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-28T14:36:34Z"
}
References

Affected packages

PyPI / pyarrow

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.14.0
Fixed
0.15.1

Affected versions

0.*

0.14.0
0.14.1
0.15.0

RubyGems / red-arrow

Package

Name
red-arrow
Purl
pkg:gem/red-arrow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.14.0
Fixed
0.15.1

Affected versions

0.*

0.14.0
0.14.1
0.15.0