Registry / data / pyarrow-hotfix

pyarrow-hotfix

library0.7pypypi✓ verified 27d ago

Pyarrow-hotfix is a pure Python package designed to mitigate the PyArrow security vulnerability CVE-2023-47248, which affected PyArrow versions 0.14.0 to 14.0.0. It disables the vulnerable deserialization feature, offering a temporary solution for users unable to immediately upgrade to PyArrow 14.0.1 or later. The library is released on an as-needed basis for security patches.

data serialization auth-security

pip install pyarrow-hotfix

github ↗package ↗docs ↗

INSTALL

IMPORT

SIG · PYARROW-HOTFIX

pyarrow-hotfix

datapythonv0.7

Install

1.5s avg

Import

—

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.7 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 17.8MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.5s · import 0.000s · 18MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

pyarrow_hotfix

✓ import pyarrow_hotfix

The hotfix is activated simply by importing the `pyarrow_hotfix` module. This should be done early in your application's lifecycle to ensure the vulnerability is disabled before any potentially malicious PyArrow data is processed.

import pyarrow_hotfix import pyarrow as pa # The hotfix is applied simply by importing the module. # Any subsequent PyArrow operations will have the vulnerable feature disabled. # Example (will raise a RuntimeError if vulnerable data is encountered): # try: # pa.ipc.open_file('malicious_data.arrow') # except RuntimeError as e: # print(f"Caught expected error: {e}")

Debug

Known issues

breakingThe `pyarrow-hotfix` explicitly disables the `pyarrow.PyExtensionType` feature. If your existing workloads rely on `pyarrow.PyExtensionType` for processing Parquet or other Arrow files, importing this hotfix will cause those workloads to fail with a `RuntimeError` related to 'forbidden deserialization of 'arrow.py_extension_type''.

fix

The recommended long-term solution is to upgrade to PyArrow 14.0.1 or later. If upgrading PyArrow is not immediately possible, consider refactoring your code to use the secure API `pyarrow.ExtensionType` instead of `pyarrow.PyExtensionType`.

affects: PyArrow versions 0.14.0 to 14.0.0 when `pyarrow-hotfix` is active.

gotchaWhile `pyarrow-hotfix` addresses the CVE-2023-47248 vulnerability, it is a temporary measure. The Apache Arrow community strongly recommends upgrading to PyArrow 14.0.1 or later as the definitive solution.

fix

Prioritize upgrading your `pyarrow` dependency to version 14.0.1 or higher to fully resolve the underlying vulnerability and remove the need for the hotfix package.

affects: <14.0.1

gotchaFor installations via `pip`, both `pyarrow-hotfix` and `pyarrow_hotfix` are accepted package names and point to the same package on PyPI. However, consistency in naming (`pyarrow-hotfix` for `pip` and `import pyarrow_hotfix`) is good practice.

fix

Always use `pip install pyarrow-hotfix` for installation and `import pyarrow_hotfix` in your Python code for clarity and consistency.

affects: All versions

breakingThe `pyarrow` library is a dependency for `pyarrow-hotfix` and must be installed for the hotfix to be relevant. The test environment failed because `pyarrow` itself was not found.

fix

Ensure that `pyarrow` is installed in your environment before attempting to use or hotfix it. For example, `pip install pyarrow`.

affects: All versions where `pyarrow` is not installed.

breakingThe script fails with a `ModuleNotFoundError` because the `pyarrow` library is not installed. This prevents the execution of any code that depends on `pyarrow`.

fix

Ensure `pyarrow` is installed in your environment. For example, add `pip install pyarrow` to your project's dependencies or installation steps.

affects: All versions (where `pyarrow` is expected)

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'pyarrow_hotfix'

The 'pyarrow-hotfix' package has not been installed in your Python environment or is not accessible on the Python path.

fix

Install the package using pip: `pip install pyarrow_hotfix`

RuntimeError: forbidden deserialization of 'arrow.py_extension_type'

The 'pyarrow-hotfix' library has successfully detected and blocked an attempt to deserialize data using the vulnerable `arrow.py_extension_type` feature, as intended to mitigate CVE-2023-47248.

fix

This is often the intended behavior, signifying the hotfix is working. If you legitimately need to deserialize data that uses `pyarrow.PyExtensionType` (which is the insecure type), you must either upgrade PyArrow to version 14.0.1 or later, or refactor your code and data to use `pyarrow.ExtensionType` (the secure API).

PyArrow security vulnerability CVE-2023-47248 still present (despite pyarrow-hotfix installation)

While 'pyarrow-hotfix' might be installed, it needs to be explicitly imported in your application code to activate the hotfix and disable the vulnerable deserialization feature.

fix

Add `import pyarrow_hotfix` at the beginning of your application's entry point or any module that uses PyArrow to ensure the hotfix takes effect.

Upgrade

Version history

0.7latest on PyPI · released Apr 25, 2025

Audit

Dependencies

pyarrowrequiredThis package is a hotfix for `pyarrow` and assumes `pyarrow` is already installed.

Agent activity

13 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/pitrou/pyarrow-hotfix#readme ↗

packagehttps://pypi.org/project/pyarrow-hotfix/ ↗

docshttps://github.com/pitrou/pyarrow-hotfix#readme ↗