erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-x563-6hqv-26mr: Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file

Impact Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution.

GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Nov 17, 2023

Should you act?

  • Malicious code, not a bug. If any listed version was ever installed, assume the machine and every secret on it are compromised: remove it, rotate credentials, rebuild.
  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with pip-audit (or: pip show <package>).
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
PyPIibis-framework< 7.1.07.1.0

Details

Impact

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.

Note that Ibis itself makes extremely limited use of pyarrow.parquet.readtable:

1. readtable is used in tests, where the input file is entirely controlled by the Ibis developers 2. readtable is used in the ibis/examples/init.py as a fallback for backends that don't support reading Parquet directly. Parquet data used in ibis.examples are also managed by the Ibis developers. This Parquet data is generated from CSV files and SQLite databases. 3. The Pandas and Dask backends both use PyArrow to read Parquet files and are therefore affected.

Ibis does not make use of APIs that directly read from either Arrow IPC files or Feather files.

Patches

Ibis imports the pyarrowhotfix package wherever pyarrow is used, as of version 7.1.0.

Upgrading to Arrow 14.0.1 is also a possible solution, starting in Ibis 7.1.0.

Sources and references

  1. GitHub Advisory GHSA-x563-6hqv-26mr github.com
  2. github.com github.com
  3. github.com github.com
  4. github.com github.com

Critical PyPI advisories · Today’s Security Digest