Also, how do we get the advisory to be published in https://github.com/apache/arrow/security/advisories ?

(note that Apache projects are bit special: only the Apache Software Foundation's infrastructure team has admin access to GitHub repositories, project maintainers don't)

Also, how do we get the advisory to be published in https://github.com/apache/arrow/security/advisories ?

(note that Apache projects are bit special: only the Apache Software Foundation's infrastructure team has admin access to GitHub repositories, project maintainers don't)

Hi @pitrou, thanks for reaching out about CVE-2023-47248! Documentation about how to publish a repository security advisory is available here: https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories

I think a fix commit would be a good link to have in the references. Is this the fix for CVE-2023-47428? apache/arrow@f141709

Hi @pitrou, thanks for reaching out about CVE-2023-47248! Documentation about how to publish a repository security advisory is available here: https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories

Ah! I was hoping that you would be able to automatically create a repository security advisory from this one?

I think a fix commit would be a good link to have in the references. Is this the fix for CVE-2023-47428? apache/arrow@f141709

Yes, it is.

I think a fix commit would be a good link to have in the references. Is this the fix for CVE-2023-47428? apache/arrow@f141709

Also, you could add a link to https://pypi.org/project/pyarrow-hotfix/ or https://github.com/pitrou/pyarrow-hotfix as a mitigation.

Hi @pitrou! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!