search

apache / arrow

Apache Arrow is a multi-language toolbox for accelerated data interchange and in-memory processing
https://arrow.apache.org/
Apache License 2.0
14.3k stars 3.48k forks source link

Minimum required numpy version (1.16.6) has security vulnerability #35846

Open diegohavenstein opened 1 year ago

diegohavenstein commented 1 year ago

Describe the bug, including details regarding any error messages, version, and platform.

We currently use version 11.0.0 of pyarrow. We run Snyk checks to find vulnerabilities in our third party dependencies

In the version we use, but also on main, the setup.py file states numpy >= 1.16.6 is required (https://github.com/apache/arrow/blob/main/python/setup.py#L451)

This Python version is affected by the following vulnerability: https://security.snyk.io/vuln/SNYK-PYTHON-NUMPY-2321964

To solve the issue, version 1.22.2 or higher should be required

Component(s)

Python

danepitkin commented 1 year ago

Hey @diegohavenstein, thanks for bringing this up. While I would definitely encourage users to install a numpy version w/o known vulnerabilities, I don't think we want to enforce it in this case given that numpy 1.22.2 was released just a little over a year ago (Feb 3, 2022)[1]. Snyk also reports the known vulnerabilities as low severity, so it's probably best to allow users additional time to upgrade their numpy version.

[1]https://pypi.org/project/numpy/1.22.2/

jorisvandenbossche commented 1 year ago

Indeed, it is up to applications and end users to ensure they use a newer numpy version in case those security reports are relevant for them (for many users scripting locally, it is not relevant at all), and not for libraries starting to limit allowed versions.

https://github.com/numpy/numpy/issues/19038 is also an interesting read (about the (non-)usefulness of those CVEs), and essentially disputes the vulnerability, quoting:

Not a meaningful vulnerability because triggering the issue seems only plausible if the malicious party already has the privilege to run NumPy commands. Thus, while a bug, it does not present an escalation of privilege.