Apache Arrow 14.0.1 Release

Published 09 Nov 2023
By The Apache Arrow PMC (pmc)

The Apache Arrow team is pleased to announce the 14.0.1 release of Apache Arrow.

This release contains a single security fix for PyArrow. Other implementations are unchanged.

It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. Binary packages are available on PyPI and conda-forge.

If it is not possible to upgrade, we provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See usage instructions.

Vulnerability description

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).

This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.

Reference: CVE-2023-47248.