[ARROW-6984] [C++] Update LZ4 to 1.9.2 for CVE-2019-17543

• Type: Wish
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.15.0
• Fix Version/s: 0.16.0
• Component/s: C++
• Labels: pull-request-available
• Flags: Patch, Important
• External issue URL: https://github.com/apache/arrow/issues/23298
• Assignee: Krisztian Szucs
• Reporter: Sangeeth Keeriyadath
• Created: 24/Oct/19 13:11
• Updated: 11/Jan/23 07:50
• Resolved: 06/Nov/19 14:01

Description

There is a reported CVE that LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (More details in here - https://nvd.nist.gov/vuln/detail/CVE-2019-17543 ). I see that Apache Arrow uses v1.8.3 version ( https://github.com/apache/arrow/blob/47e5ecafa72b70112a64a1174b29b9db45f803ef/cpp/thirdparty/versions.txt#L38 ).

We need to bump up the dependency version of LZ4 to 1.9.2 to get past the reported CVE. Thank you!

Issue Links

• links to: GitHub Pull Request #5728