ray-project · ray-project/ray
The flaw is a local file inclusion (path traversal) vulnerability in the log API endpoint of Ray, the ray-project/ray product. An attacker can read arbitrary files on the server over the network without authenticating and without any user interaction.
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Disclosed on 16 Nov 2023. No public exploit code or confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: ray.
Upgrade to 2.52.0 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2023-48022, CVE-2023-6019, +2).
pip install "ray>=2.52.0"First fixed in 2.8.1 for CVE-2023-6021.
| If you run | Upgrade to |
|---|---|
| All versions before 2.8.1 | 2.52.0first fix for this CVE: 2.8.1 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2023-6021 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.