Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/44568?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/44568?format=api", "purl": "pkg:pypi/ray@2.8.1", "type": "pypi", "namespace": "", "name": "ray", "version": "2.8.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.43.0", "latest_non_vulnerable_version": "2.43.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36983?format=api", "vulnerability_id": "VCID-bu1m-265h-f7h4", "summary": "Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password.\r\rThis is only exploitable if:\r\r1) Logging is enabled;\r\r2) Redis is using password authentication;\r\r3) Those logs are accessible to an attacker, who can reach that redis instance.\r\r**Note:**\r\rIt is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.", "references": [ { "reference_url": "https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d" }, { "reference_url": "https://github.com/ray-project/ray/issues/50266", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray/issues/50266" }, { "reference_url": "https://github.com/ray-project/ray/pull/50409", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray/pull/50409" }, { "reference_url": "https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44597?format=api", "purl": "pkg:pypi/ray@2.43.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.43.0" } ], "aliases": [ "CVE-2025-1979", "PYSEC-2025-23" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bu1m-265h-f7h4" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46424?format=api", "vulnerability_id": "VCID-79ae-r9sy-kuc3", "summary": "Ray Missing Authorization vulnerability\nLFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "references": [ { "reference_url": "https://github.com/ray-project/ray", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray" }, { "reference_url": "https://github.com/ray-project/ray/releases/tag/ray-2.8.1", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray/releases/tag/ray-2.8.1" }, { "reference_url": "https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6", "reference_id": "", "reference_type": "", "scores": [], "url": "https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6" }, { "reference_url": "https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6020", "reference_id": "CVE-2023-6020", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6020" }, { "reference_url": "https://github.com/advisories/GHSA-6cxr-8q3m-jwrr", "reference_id": "GHSA-6cxr-8q3m-jwrr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6cxr-8q3m-jwrr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44568?format=api", "purl": "pkg:pypi/ray@2.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bu1m-265h-f7h4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.8.1" } ], "aliases": [ "CVE-2023-6020", "GHSA-6cxr-8q3m-jwrr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-79ae-r9sy-kuc3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46414?format=api", "vulnerability_id": "VCID-9s66-w31a-p7gd", "summary": "Ray OS Command Injection vulnerability\nA command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.", "references": [ { "reference_url": "https://github.com/ray-project/ray", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray" }, { "reference_url": "https://github.com/ray-project/ray/releases/tag/ray-2.8.1", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray/releases/tag/ray-2.8.1" }, { "reference_url": "https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe", "reference_id": "", "reference_type": "", "scores": [], "url": "https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe" }, { "reference_url": "https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6019", "reference_id": "CVE-2023-6019", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6019" }, { "reference_url": "https://github.com/advisories/GHSA-h3xg-wv58-5p43", "reference_id": "GHSA-h3xg-wv58-5p43", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-h3xg-wv58-5p43" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44568?format=api", "purl": "pkg:pypi/ray@2.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bu1m-265h-f7h4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.8.1" } ], "aliases": [ "CVE-2023-6019", "GHSA-h3xg-wv58-5p43" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9s66-w31a-p7gd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46425?format=api", "vulnerability_id": "VCID-hfx6-9t71-qkfw", "summary": "Ray Path Traversal vulnerability\nLFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "references": [ { "reference_url": "https://github.com/ray-project/ray", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray" }, { "reference_url": "https://github.com/ray-project/ray/releases/tag/ray-2.8.1", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/ray-project/ray/releases/tag/ray-2.8.1" }, { "reference_url": "https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8", "reference_id": "", "reference_type": "", "scores": [], "url": "https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8" }, { "reference_url": "https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6021", "reference_id": "CVE-2023-6021", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6021" }, { "reference_url": "https://github.com/advisories/GHSA-3pww-qvr8-6mhp", "reference_id": "GHSA-3pww-qvr8-6mhp", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-3pww-qvr8-6mhp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44568?format=api", "purl": "pkg:pypi/ray@2.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bu1m-265h-f7h4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.8.1" } ], "aliases": [ "CVE-2023-6021", "GHSA-3pww-qvr8-6mhp" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hfx6-9t71-qkfw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37244?format=api", "vulnerability_id": "VCID-m5xy-sdtw-3uh7", "summary": "A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.", "references": [ { "reference_url": "https://github.com/ray-project/ray", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/ray-project/ray" }, { "reference_url": "https://packetstorm.news/files/id/215801/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://packetstorm.news/files/id/215801/" }, { "reference_url": "https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44568?format=api", "purl": "pkg:pypi/ray@2.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bu1m-265h-f7h4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.8.1" } ], "aliases": [ "CVE-2026-32981", "PYSEC-2026-130" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m5xy-sdtw-3uh7" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/ray@2.8.1" }