GHSA-3pww-qvr8-6mhp

Ray Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-6021

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ray	< 2.8.1	2.8.1

Details

As written in the advisory (Markdown source, shown as plain text).

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-6021 advisory
https://github.com/ray-project/ray web
https://github.com/ray-project/ray/releases/tag/ray-2.8.1 web
https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8 web
https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 web