Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/ray@2.4.0
Typepypi
Namespace
Nameray
Version2.4.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.43.0
Latest_non_vulnerable_version2.54.0
Affected_by_vulnerabilities
0
url VCID-bu1m-265h-f7h4
vulnerability_id VCID-bu1m-265h-f7h4
summary Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only exploitable if: 1) Logging is enabled; 2) Redis is using password authentication; 3) Those logs are accessible to an attacker, who can reach that redis instance. **Note:** It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.
references
0
reference_url https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d
reference_id
reference_type
scores
url https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d
1
reference_url https://github.com/ray-project/ray/issues/50266
reference_id
reference_type
scores
url https://github.com/ray-project/ray/issues/50266
2
reference_url https://github.com/ray-project/ray/pull/50409
reference_id
reference_type
scores
url https://github.com/ray-project/ray/pull/50409
3
reference_url https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212
reference_id
reference_type
scores
url https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212
fixed_packages
0
url pkg:pypi/ray@2.43.0
purl pkg:pypi/ray@2.43.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.43.0
aliases CVE-2025-1979, PYSEC-2025-23
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bu1m-265h-f7h4
1
url VCID-m5xy-sdtw-3uh7
vulnerability_id VCID-m5xy-sdtw-3uh7
summary A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
references
0
reference_url https://github.com/ray-project/ray
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://github.com/ray-project/ray
1
reference_url https://packetstorm.news/files/id/215801/
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://packetstorm.news/files/id/215801/
2
reference_url https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure
fixed_packages
0
url pkg:pypi/ray@2.8.1
purl pkg:pypi/ray@2.8.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bu1m-265h-f7h4
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.8.1
aliases CVE-2026-32981, PYSEC-2026-130
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-m5xy-sdtw-3uh7
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.4.0