CVE-2019-12408: 
Python vulnerability analysis and mitigation

Apache Arrow versions 0.14.0 to 0.14.1 contained an uninitialized memory vulnerability (CVE-2019-12408) in its C++ implementation, which also affects the R, Python, and Ruby implementations. The vulnerability was discovered and disclosed in November 2019, affecting the core functionality of building arrays with null values (Debian Security, NVD).

The vulnerability manifests as an uninitialized memory bug when building arrays with null values in specific cases. This issue is particularly concerning as it affects the C++ implementation, which serves as the foundation for multiple language bindings including R, Python, and Ruby. The bug can result in uninitialized memory being inadvertently exposed when Arrow Arrays are transmitted through network communications (such as with Flight) or when they are stored in streaming IPC and file formats (Debian Security).

The vulnerability could lead to unintentional sharing of uninitialized memory when Arrow Arrays are transmitted over the network or when they are persisted in streaming IPC and file formats. This could potentially expose sensitive information contained in memory to unauthorized parties (NVD).

The vulnerability was addressed in Apache Arrow version 0.15.1, which contains patches for this uninitialized memory bug. Users are advised to upgrade to this version or later to mitigate the vulnerability (Apache Lists).