CVE-2023-47248 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2023-47248 Interim 1 9 2025-08-06T01:22:31Z current 2023-11-10T00:08:45Z 2025-08-06T01:22:31Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2023-47248 Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 openSUSE Tumbleweed python-arrow python3-arrow python310-geopandas-0.14.1-1.1 python310-pandas-2.1.3-1.1 python310-pandas-all-2.1.3-1.1 python310-pandas-clipboard-2.1.3-1.1 python310-pandas-compression-2.1.3-1.1 python310-pandas-computation-2.1.3-1.1 python310-pandas-excel-2.1.3-1.1 python310-pandas-feather-2.1.3-1.1 python310-pandas-fss-2.1.3-1.1 python310-pandas-hdf5-2.1.3-1.1 python310-pandas-html-2.1.3-1.1 python310-pandas-mysql-2.1.3-1.1 python310-pandas-output_formatting-2.1.3-1.1 python310-pandas-parquet-2.1.3-1.1 python310-pandas-performance-2.1.3-1.1 python310-pandas-plot-2.1.3-1.1 python310-pandas-postgresql-2.1.3-1.1 python310-pandas-spss-2.1.3-1.1 python310-pandas-sql-other-2.1.3-1.1 python310-pandas-test-2.1.3-1.1 python310-pandas-xml-2.1.3-1.1 python310-pyarrow-14.0.1-2.1 python310-pyarrow-devel-14.0.1-2.1 python311-arrow python311-geopandas-0.14.1-1.1 python311-pandas-2.1.3-1.1 python311-pandas-all-2.1.3-1.1 python311-pandas-clipboard-2.1.3-1.1 python311-pandas-compression-2.1.3-1.1 python311-pandas-computation-2.1.3-1.1 python311-pandas-excel-2.1.3-1.1 python311-pandas-feather-2.1.3-1.1 python311-pandas-fss-2.1.3-1.1 python311-pandas-hdf5-2.1.3-1.1 python311-pandas-html-2.1.3-1.1 python311-pandas-mysql-2.1.3-1.1 python311-pandas-output_formatting-2.1.3-1.1 python311-pandas-parquet-2.1.3-1.1 python311-pandas-performance-2.1.3-1.1 python311-pandas-plot-2.1.3-1.1 python311-pandas-postgresql-2.1.3-1.1 python311-pandas-spss-2.1.3-1.1 python311-pandas-sql-other-2.1.3-1.1 python311-pandas-test-2.1.3-1.1 python311-pandas-xml-2.1.3-1.1 python311-pyarrow-14.0.1-2.1 python311-pyarrow-devel-14.0.1-2.1 python39-geopandas-0.14.1-1.1 python39-pandas-2.1.3-1.1 python39-pandas-all-2.1.3-1.1 python39-pandas-clipboard-2.1.3-1.1 python39-pandas-compression-2.1.3-1.1 python39-pandas-computation-2.1.3-1.1 python39-pandas-excel-2.1.3-1.1 python39-pandas-feather-2.1.3-1.1 python39-pandas-fss-2.1.3-1.1 python39-pandas-hdf5-2.1.3-1.1 python39-pandas-html-2.1.3-1.1 python39-pandas-mysql-2.1.3-1.1 python39-pandas-output_formatting-2.1.3-1.1 python39-pandas-parquet-2.1.3-1.1 python39-pandas-performance-2.1.3-1.1 python39-pandas-plot-2.1.3-1.1 python39-pandas-postgresql-2.1.3-1.1 python39-pandas-spss-2.1.3-1.1 python39-pandas-sql-other-2.1.3-1.1 python39-pandas-test-2.1.3-1.1 python39-pandas-xml-2.1.3-1.1 python39-pyarrow-14.0.1-2.1 python39-pyarrow-devel-14.0.1-2.1 python310-geopandas-0.14.1-1.1 as a component of openSUSE Tumbleweed python310-pandas-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-all-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-clipboard-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-compression-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-computation-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-excel-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-feather-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-fss-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-hdf5-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-html-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-mysql-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-output_formatting-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-parquet-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-performance-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-plot-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-postgresql-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-spss-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-sql-other-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-test-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pandas-xml-2.1.3-1.1 as a component of openSUSE Tumbleweed python310-pyarrow-14.0.1-2.1 as a component of openSUSE Tumbleweed python310-pyarrow-devel-14.0.1-2.1 as a component of openSUSE Tumbleweed python311-geopandas-0.14.1-1.1 as a component of openSUSE Tumbleweed python311-pandas-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-all-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-clipboard-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-compression-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-computation-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-excel-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-feather-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-fss-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-hdf5-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-html-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-mysql-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-output_formatting-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-parquet-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-performance-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-plot-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-postgresql-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-spss-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-sql-other-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-test-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pandas-xml-2.1.3-1.1 as a component of openSUSE Tumbleweed python311-pyarrow-14.0.1-2.1 as a component of openSUSE Tumbleweed python311-pyarrow-devel-14.0.1-2.1 as a component of openSUSE Tumbleweed python39-geopandas-0.14.1-1.1 as a component of openSUSE Tumbleweed python39-pandas-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-all-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-clipboard-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-compression-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-computation-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-excel-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-feather-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-fss-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-hdf5-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-html-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-mysql-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-output_formatting-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-parquet-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-performance-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-plot-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-postgresql-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-spss-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-sql-other-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-test-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pandas-xml-2.1.3-1.1 as a component of openSUSE Tumbleweed python39-pyarrow-14.0.1-2.1 as a component of openSUSE Tumbleweed python39-pyarrow-devel-14.0.1-2.1 as a component of openSUSE Tumbleweed python3-arrow as a component of SUSE Enterprise Storage 7.1 python-arrow as a component of SUSE Enterprise Storage 7.1 python3-arrow as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS python-arrow as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS python3-arrow as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS python-arrow as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS python3-arrow as a component of SUSE Linux Enterprise Module for Containers 15 SP4 python-arrow as a component of SUSE Linux Enterprise Module for Containers 15 SP4 python3-arrow as a component of SUSE Linux Enterprise Module for Containers 15 SP5 python-arrow as a component of SUSE Linux Enterprise Module for Containers 15 SP5 python311-arrow as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python-arrow as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python311-arrow as a component of SUSE Linux Enterprise Module for Python 3 15 SP5 python-arrow as a component of SUSE Linux Enterprise Module for Python 3 15 SP5 python3-arrow as a component of SUSE Linux Enterprise Server 15 SP3-LTSS python-arrow as a component of SUSE Linux Enterprise Server 15 SP3-LTSS python3-arrow as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 python-arrow as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions. CVE-2023-47248 openSUSE Tumbleweed:python310-geopandas-0.14.1-1.1 openSUSE Tumbleweed:python310-pandas-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-all-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-clipboard-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-compression-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-computation-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-excel-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-feather-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-fss-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-hdf5-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-html-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-mysql-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-output_formatting-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-parquet-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-performance-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-plot-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-postgresql-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-spss-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-sql-other-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-test-2.1.3-1.1 openSUSE Tumbleweed:python310-pandas-xml-2.1.3-1.1 openSUSE Tumbleweed:python310-pyarrow-14.0.1-2.1 openSUSE Tumbleweed:python310-pyarrow-devel-14.0.1-2.1 openSUSE Tumbleweed:python311-geopandas-0.14.1-1.1 openSUSE Tumbleweed:python311-pandas-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-all-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-clipboard-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-compression-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-computation-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-excel-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-feather-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-fss-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-hdf5-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-html-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-mysql-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-output_formatting-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-parquet-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-performance-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-plot-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-postgresql-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-spss-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-sql-other-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-test-2.1.3-1.1 openSUSE Tumbleweed:python311-pandas-xml-2.1.3-1.1 openSUSE Tumbleweed:python311-pyarrow-14.0.1-2.1 openSUSE Tumbleweed:python311-pyarrow-devel-14.0.1-2.1 openSUSE Tumbleweed:python39-geopandas-0.14.1-1.1 openSUSE Tumbleweed:python39-pandas-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-all-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-clipboard-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-compression-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-computation-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-excel-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-feather-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-fss-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-hdf5-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-html-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-mysql-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-output_formatting-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-parquet-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-performance-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-plot-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-postgresql-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-spss-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-sql-other-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-test-2.1.3-1.1 openSUSE Tumbleweed:python39-pandas-xml-2.1.3-1.1 openSUSE Tumbleweed:python39-pyarrow-14.0.1-2.1 openSUSE Tumbleweed:python39-pyarrow-devel-14.0.1-2.1 SUSE Enterprise Storage 7.1:python-arrow SUSE Enterprise Storage 7.1:python3-arrow SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:python-arrow SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:python3-arrow SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:python-arrow SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:python3-arrow SUSE Linux Enterprise Module for Containers 15 SP4:python-arrow SUSE Linux Enterprise Module for Containers 15 SP4:python3-arrow SUSE Linux Enterprise Module for Containers 15 SP5:python-arrow SUSE Linux Enterprise Module for Containers 15 SP5:python3-arrow SUSE Linux Enterprise Module for Python 3 15 SP4:python-arrow SUSE Linux Enterprise Module for Python 3 15 SP4:python311-arrow SUSE Linux Enterprise Module for Python 3 15 SP5:python-arrow SUSE Linux Enterprise Module for Python 3 15 SP5:python311-arrow SUSE Linux Enterprise Server 15 SP3-LTSS:python-arrow SUSE Linux Enterprise Server 15 SP3-LTSS:python3-arrow SUSE Linux Enterprise Server for SAP Applications 15 SP3:python-arrow SUSE Linux Enterprise Server for SAP Applications 15 SP3:python3-arrow critical 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H