CVE-2019-12410: 
Python vulnerability analysis and mitigation

Apache Arrow versions from 0.12.0 to 0.14.1 contained a vulnerability that left memory Array data uninitialized when reading RLE null data from parquet files. This vulnerability affected the C++, Python, Ruby and R implementations (Apache Security).

The vulnerability (CVE-2019-12410) was present in the data reading functionality when processing RLE (Run Length Encoding) null encoded data from Apache Parquet files. The bug caused the data segment to remain uninitialized, potentially exposing sensitive information if the Arrays were transmitted over the wire using Flight or persisted in streaming IPC and file formats. Notably, this issue did not affect data persisted to the Apache Parquet file format (Apache Security).

The vulnerability could potentially lead to unintentional data exposure if Arrow Arrays containing uninitialized memory were transmitted over the network using Flight or saved in streaming IPC and file formats. This could result in sensitive information leakage from memory (Apache Security).

Users are recommended to upgrade to Apache Arrow version 0.15.1 which contains the fix for this vulnerability. Additionally, users should audit any data that has been persisted in the Arrow IPC format or the Arrow File Format (Apache Security).