Source: apache-arrow Version: 25.0.0-2 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream Forwarded: https://github.com/apache/arrow/issues/51349
Hi, The following vulnerability was published for apache-arrow. CVE-2026-92287[0]: | Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ | Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users | who read Parquet files and configure Parquet decryption properties | with a KmsClient implementation. On the reader side, the KMS URL | can be application-controlled (specified in the KmsConnectionConfig) | or file-controlled. If the user does not leverage application | control for this parameter, a file-controlled KMS URL is forwarded | to a pluggable KmsClient implementation. If the KMS implementation | does not perform host validation and makes use of the provided KMS | URL, a KMS token can be sent to a malicious host set by an attacker | in the file. Users are recommended to upgrade to version | 26.0.0, which disables this behavior by default and requires that | users opt-in to it by enabling the read_kms_url flag in | the DecryptionConfiguration. Users of affected versions are | recommended to either specify the KMS URL in the KmsConnectionConfig | when reading files, or ensure any KmsClient implementations validate | received KMS URLs. Users that opt-in to file-controlled KMS URLs in | version 26.0.0 and later must ensure KmsClients validate KMS URLs. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92287 https://www.cve.org/CVERecord?id=CVE-2026-92287 [1] https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57 [2] https://github.com/apache/arrow/issues/51349 [3] https://github.com/apache/arrow/pull/51350 Regards, Salvatore
