Ray Path Traversal vulnerability (GHSA-3pww-qvr8-6mhp) · Sieve

치명취약점

Ray Path Traversal vulnerability

GHSA-3pww-qvr8-6mhp · CVE-2023-6021 · PYSEC-2026-515 · 갱신 2026. 9. 10.

해야 할 일

ray: 2.8.1 이상으로 올리세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	ray	2.8.1

원문

Ray Path Traversal vulnerability

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

출처

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-6021
WEBhttps://github.com/ray-project/ray
WEBhttps://github.com/ray-project/ray/releases/tag/ray-2.8.1
WEBhttps://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8
WEBhttps://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

오늘 목록으로