Advisoriesby IbisApache ArrowGHSA-8cw2-jv5c-c825
Missing Initialization of Resource in Apache Arrow
Fix: upgrade to 0.15.1 or later
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pyarrow PyPI | >= 0.14.0, < 0.15.1 | 0.15.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-909
- Also known as
- CVE-2019-12408, PYSEC-2019-195
- nvd.nist.gov/vuln/detail/CVE-2019-12408
- github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2019-195.yaml
- github.com/rubysec/ruby-advisory-db/blob/master/gems/red-arrow/CVE-2019-12408.yml
- lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E
- lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E
More Apache Arrow advisories
All Apache Arrow
Apache Arrow: Potential use-after-free when reading IPC file with pre-bufferingCVE-2026-25087fixed in 23.0.1Apache Arrow: unsafe deserializationCVE-2024-52338fixed in 17.0.0PyArrow: Arbitrary code execution when loading a malicious data fileCVE-2023-47248fixed in 14.0.1Missing Initialization of Resource in Apache ArrowCVE-2019-12410fixed in 0.15.1