Ray OS Command Injection vulnerability

GHSA-h3xg-wv58-5p43 · CVE-2023-6019 · PYSEC-2026-519 · 갱신 2026. 9. 10.

해야 할 일

ray: 2.8.1 이상으로 올리세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	ray	2.8.1

원문

Ray OS Command Injection vulnerability

A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.

출처

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-6019
WEBhttps://github.com/ray-project/ray
WEBhttps://github.com/ray-project/ray/releases/tag/ray-2.8.1
WEBhttps://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe
WEBhttps://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

오늘 목록으로

Ray OS Command Injection vulnerability (GHSA-h3xg-wv58-5p43) · Sieve