id: PYSEC-2019-196
details: While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365
  it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data
  uninitialized when reading RLE null data from parquet. This affected the C++, Python,
  Ruby and R implementations. The uninitialized memory could potentially be shared
  if are transmitted over the wire (for instance with Flight) or persisted in the
  streaming IPC and file formats.
affected:
- package:
    name: pyarrow
    ecosystem: PyPI
    purl: pkg:pypi/pyarrow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.12.0
    - fixed: 0.15.0
  versions:
  - 0.12.0
  - 0.12.1
  - 0.13.0
  - 0.14.0
  - 0.14.1
references:
- type: WEB
  url: https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2019/11/08/1
- type: WEB
  url: https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cjw4-2w9r-r8mv
aliases:
- CVE-2019-12410
- GHSA-cjw4-2w9r-r8mv
modified: "2021-08-27T03:22:16.568373Z"
published: "2019-11-08T19:15:00Z"