You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "alamb (via GitHub)" <gi...@apache.org> on 2026/04/15 11:19:19 UTC
[PR] [GH 49760]: Document differences between bugs and security vulnerabilities [arrow]
alamb opened a new pull request, #49761:
URL: https://github.com/apache/arrow/pull/49761
### Rationale for this change
The current security model documented https://arrow.apache.org/docs/dev/format/Security.html
Does not explicitly address what constitutes a bug vs a security vulnerability. We should make this clear
### What changes are included in this PR?
Add a section to the format security document that defines bugs vs security vulnerabilitty
### Are these changes tested?
Not sure
### Are there any user-facing changes?
Yes as it defines our security posture more generally
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [GH 49760]: Document differences between bugs and security vulnerabilities [arrow]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4251566500
@github-actions crossbow submit preview-docs
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4320026132
Closing this PR and we can always make a new one if we want to revisit arrow-level guidance
Thank you @tustvold and @pitrou
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "pitrou (via GitHub)" <gi...@apache.org>.
pitrou commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4297468536
Yes, I'd rather have this PR closed since I don't think it should be standardized at the format level.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4293611438
> I think such guidelines should really be implementation-specific. Some implementations may want to have different opinions on what deserves a CVE and the associated ceremonial.
FWIW I have incorporated this content into the Rust specific security model
- https://github.com/apache/arrow-rs/pull/9730
I am happy to close this PR if we prefer to keep the guidance in the language specific implementations
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "tustvold (via GitHub)" <gi...@apache.org>.
tustvold commented on code in PR #49761:
URL: https://github.com/apache/arrow/pull/49761#discussion_r3087975701
##########
docs/source/format/Security.rst:
##########
@@ -51,6 +51,34 @@ You should read this document if you belong to either of these two categories:
documented on https://arrow.apache.org.
+.. _bugs_vs_security:
+
+Bugs vs. Security Vulnerabilities
+=================================
+
+Arrow aims for robustness when processing untrusted data, but it is important to
+distinguish functional bugs from security vulnerabilities.
+
+Unexpected behavior (e.g., crashes or infinite loops) triggered by malformed
+input is generally considered a **bug**, not a security vulnerability, unless it
+is **exploitable**. An issue is exploitable if an attacker can:
+
+* Execute arbitrary code (RCE);
+* Exfiltrate sensitive information from process memory (Information Disclosure);
+* Cause a sustained Denial of Service (DoS) affecting the broader system.
Review Comment:
Here we define DoS as an exploitable issue, but then say that process crashes are not exploitable?
I think what gets tricky is technically any arrow API could be exposed by a client application, and therefore in theory could be exploitable in that applications context.
I wonder if we need to distinguish between network APIs, e.g. arrow flight, and internal APIs?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "pitrou (via GitHub)" <gi...@apache.org>.
pitrou commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4252313322
I think such guidelines should really be implementation-specific. Some implementations may want to have different opinions on what deserves a CVE and the associated ceremonial.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb closed pull request #49761: GH-49760: Document differences between bugs and security vulnerabilities
URL: https://github.com/apache/arrow/pull/49761
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #49761:
URL: https://github.com/apache/arrow/pull/49761#discussion_r3088601278
##########
docs/source/format/Security.rst:
##########
@@ -51,6 +51,34 @@ You should read this document if you belong to either of these two categories:
documented on https://arrow.apache.org.
+.. _bugs_vs_security:
+
+Bugs vs. Security Vulnerabilities
+=================================
+
+Arrow aims for robustness when processing untrusted data, but it is important to
+distinguish functional bugs from security vulnerabilities.
+
+Unexpected behavior (e.g., crashes or infinite loops) triggered by malformed
+input is generally considered a **bug**, not a security vulnerability, unless it
+is **exploitable**. An issue is exploitable if an attacker can:
+
+* Execute arbitrary code (RCE);
+* Exfiltrate sensitive information from process memory (Information Disclosure);
+* Cause a sustained Denial of Service (DoS) affecting the broader system.
Review Comment:
yeah, I was hedging with "sustained" and "affecting the broader system" . I guess in my mind I don't think we should treat panics or OOMs as security issues (they are bugs certainly)
I want it to be clear to downstream users that they need to take other precautions (like process sandboxing, and cgroups for example) to make their systems resilent rather than assume we will treat every bug as a security issue
##########
docs/source/format/Security.rst:
##########
@@ -51,6 +51,34 @@ You should read this document if you belong to either of these two categories:
documented on https://arrow.apache.org.
+.. _bugs_vs_security:
+
+Bugs vs. Security Vulnerabilities
+=================================
+
+Arrow aims for robustness when processing untrusted data, but it is important to
+distinguish functional bugs from security vulnerabilities.
+
+Unexpected behavior (e.g., crashes or infinite loops) triggered by malformed
+input is generally considered a **bug**, not a security vulnerability, unless it
+is **exploitable**. An issue is exploitable if an attacker can:
+
+* Execute arbitrary code (RCE);
+* Exfiltrate sensitive information from process memory (Information Disclosure);
+* Cause a sustained Denial of Service (DoS) affecting the broader system.
Review Comment:
Maybe we should just remove "denial of service" from the list 🤔
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [GH 49760]: Document differences between bugs and security vulnerabilities [arrow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4251550277
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
Thanks for opening a pull request!
If this is not a [minor PR](https://github.com/apache/arrow/blob/main/CONTRIBUTING.md#Minor-Fixes). Could you open an issue for this pull request on GitHub? https://github.com/apache/arrow/issues/new/choose
Opening GitHub issues ahead of time contributes to the [Openness](http://theapacheway.com/open/#:~:text=Openness%20allows%20new%20users%20the,must%20happen%20in%20the%20open.) of the Apache Arrow project.
Then could you also rename the pull request title in the following format?
GH-${GITHUB_ISSUE_ID}: [${COMPONENT}] ${SUMMARY}
or
MINOR: [${COMPONENT}] ${SUMMARY}
See also:
* [Other pull requests](https://github.com/apache/arrow/pulls/)
* [Contribution Guidelines - Contributing Overview](https://arrow.apache.org/docs/developers/overview.html)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4251580537
Revision: 705ce5c97a31e340d665373f8a500e65989ef627
Submitted crossbow builds: [ursacomputing/crossbow @ actions-a1e6cabe5e](https://github.com/ursacomputing/crossbow/branches/all?query=actions-a1e6cabe5e)
|Task|Status|
|----|------|
|preview-docs|[](https://github.com/ursacomputing/crossbow/actions/runs/24451807397/job/71442270204)|
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49760: Document differences between bugs and security vulnerabilities [arrow]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #49761:
URL: https://github.com/apache/arrow/pull/49761#issuecomment-4253384722
> I think such guidelines should really be implementation-specific. Some implementations may want to have different opinions on what deserves a CVE and the associated ceremonial.
I am happy to close this PR if others agree (or want this to be targeted just at the C/C++ implementation)
I made a PR for arrow-rs here and I can incorporate the guidance there too
- https://github.com/apache/arrow-rs/pull/9730
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org