id: PYSEC-2019-195
details: It was discovered that the C++ implementation (which underlies the R, Python
  and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory
  bug when building arrays with null values in some cases. This can lead to uninitialized
  memory being unintentionally shared if Arrow Arrays are transmitted over the wire
  (for instance with Flight) or persisted in the streaming IPC and file formats.
affected:
- package:
    name: pyarrow
    ecosystem: PyPI
    purl: pkg:pypi/pyarrow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.14.0
    - fixed: 0.15.0
  versions:
  - 0.14.0
  - 0.14.1
references:
- type: WEB
  url: 
    https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E
- type: WEB
  url: 
    https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8cw2-jv5c-c825
aliases:
- CVE-2019-12408
- GHSA-8cw2-jv5c-c825
modified: "2021-08-27T03:22:16.533972Z"
published: "2019-11-08T19:15:00Z"