[GHSA-rgxp-2hwp-jwgg] Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering

[noren95]

Updates

• Affected products

Comments
The vulnerabiltiy affected only the C++ implementation of Arrow and does not relate to the PyPI package.

• As the advisory states, "The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable."
• The fix is focused on the functionalities of C++, not python
  https://github.com/apache/arrow/pull/48925/changes

Could you please review this, and remove the association to pip if its a FP? Thanks

[noren95]

The improvement form does not enable the removal of the ecosystem (C++/Conan was not included in the options) - FYI

Thank you