Repository navigation
SNOW-966491: Critical security vulnerability in pyarrow<14.0.1 #1802
Description
Python version
3.10
Operating system and processor architecture
macOS-14.0-arm64-arm-64bit
Installed packages
snowflake-connector-python==3.4.0What did you do?
snowflake-connector-python pins pyarrow to 10.0.1, which is vulnerable to the Critical CVE https://nvd.nist.gov/vuln/detail/CVE-2023-47248
What did you expect to see?
pyarrow==14.0.1
Reacted by Ravi Rahman and Will Koehrsen
Activity
[-]Critical security vulnerability in `pyarrow<14.0.1`[/-][+]SNOW-966491: Critical security vulnerability in `pyarrow<14.0.1`[/+]sfc-gh-achandrasekaran commentedon Nov 10, 2023
We're going to ship an update soon. ETA is EOD Monday
sfc-gh-aling commentedon Nov 13, 2023
hey @emarx , we have just released v3.5.0 which stops pinning pyarrow anymore. could you try installing the latest connector and see if it works for you?
also for future reference, if you can't upgrade pyarrow, please read the CVE report: https://lists.apache.org/thread/4notgcj3y7j5z4vxcr6o966g52jqxpdt and install pyarrow-hotfix to patch the vulnerability.
lukehsiao commentedon Nov 14, 2023
FWIW, this works for us, thanks!
captnswing commentedon Nov 14, 2023
Thanks for reporting @emarx and thanks for fixing @sfc-gh-aling 🙏🏼