gen2-connector (>=1.0.0b44, <=1.0.0b47) potentially affected by CVE-2023-48022 via ray (1.5.1)

ray PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - gen2-connector =1.0.0b44, =1.0.0b47 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

flopyarcade (>=0.3.35, <=0.6.3), gen2-connector (1.0.0b61) +1 more potentially affected by CVE-2023-48022 via ray (1.9.2)

ray PYPI version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - flopyarcade =0.3.35, =0.0.7, =0.1.4 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

gym-jiminy-rllib (1.6.27), gym-recorder (>=0.0.2, <=0.0.3) +5 more potentially affected by CVE-2023-48022 via ray (1.4.1)

ray PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - gym-jiminy-rllib 1.6.27 - gym-recorder =0.0.2, =1.6.3, =2.1.41, =2021.7.21.dev0, =2021.7.30.dev0 - raylab 0.15.10 Source cves: CVE-2023-48022 Source...

pyebsdindex (0.1.0rc2) potentially affected by CVE-2023-48022 via ray (1.11.1)

ray PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - pyebsdindex 0.1.0rc2 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

gen2-connector (>=1.0.0b57, <=1.0.0b59), kserve (>=0.8.0rc0, <=0.8.0.2) +2 more potentially affected by CVE-2023-48022 via ray (1.9.0)

ray PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - gen2-connector =1.0.0b57, =0.8.0rc0, =0.0.2, =0.1.0, =0.1.2 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

biome-text (3.3.0), discern-reconstruction (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2023-48022 via ray (1.6.0)

ray PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - biome-text 3.3.0 - discern-reconstruction =0.1.0, =0.1.7, =0.0.3.dev0, =0.2.4, =1.3.0, =2.2.10 - raylab 0.16.1 Source cves: CVE-2023-48022 Source advisory...

abmarl (>=0.2.3, <=0.2.4), autogluon (>=0.4.3b20220611, <=0.4.3b20220617) +4 more potentially affected by CVE-2023-48022 via ray (1.12.1)

ray PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.3, =0.4.3b20220611, =3.1.1, =2022.7.7.dev1, =1.2.0, =1.2.1 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

gen2-connector (1.0.0b60), pynb-dag-runner (>=0.0.6, <=0.0.9) +2 more potentially affected by CVE-2023-48022 via ray (1.9.1)

ray PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - gen2-connector 1.0.0b60 - pynb-dag-runner =0.0.6, =0.0.4.dev1661688916, =0.0.4, =0.0.6 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP...

Ray has arbitrary code execution via jobs submission API

Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment...

GHSA-6WGJ-66M2-XXP2 Ray has arbitrary code execution via jobs submission API

Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment...

smarts (>=0.4.2, <=0.4.6.post0), ultra-rl (>=0.1.0, <=0.1.1) potentially affected by CVE-2023-48022 via ray (0.8.3)

ray PYPI version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - smarts =0.4.2, =0.1.0, =0.1.1 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

modin (0.1.2) potentially affected by CVE-2023-48022 via ray (0.5.2)

ray PYPI version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin 0.1.2 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

flambe (>=0.4.11, <=0.4.13) potentially affected by CVE-2023-48022 via ray (0.7.6)

ray PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - flambe =0.4.11, =0.4.13 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

encdecmeta (0.0.3), nevopy (>=0.0.1, <=0.2.3) potentially affected by CVE-2023-48022 via ray (1.1.0)

ray PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - encdecmeta 0.0.3 - nevopy =0.0.1, =0.2.3 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2023-48022 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2023-48022 Source advisory:...

opensoundscape (>=0.4.0, <=0.5.0), pdf2dataset (>=0.4.0, <=0.5.3) +3 more potentially affected by CVE-2023-48022 via ray (0.8.7)

ray PYPI version 0.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - opensoundscape =0.4.0, =0.4.0, =0.8.3, =0.1.0, =0.0.0, =0.1.4 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

modin (0.6.0) potentially affected by CVE-2023-48022 via ray (0.7.3)

ray PYPI version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin 0.6.0 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

biome-text (>=3.0.0, <=3.2.1), deepcomp (>=1.2.4, <=1.2.5) +7 more potentially affected by CVE-2023-48022 via ray (1.3.0)

ray PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - biome-text =3.0.0, =1.2.4, =0.4.2rc0, =0.0.7, =0.2.0, =2021.6.12.dev0, =2021.6.17.dev0 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP...

abmarl (>=0.1.1, <=0.1.3), deepcomp (>=1.1.0, <=1.2.3) +5 more potentially affected by CVE-2023-48022 via ray (1.2.0)

ray PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.1.1, =1.1.0, =0.1.3, =0.15.7, =0.15.9 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...

connector-db-tools (0.0.1), pdf2dataset (>=0.1.0, <=0.4.0a1) +1 more potentially affected by CVE-2023-48022 via ray (0.8.6)

ray PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - connector-db-tools 0.0.1 - pdf2dataset =0.1.0, =0.4.10, =0.4.11 Source cves: CVE-2023-48022 Source advisory: OSV:GHSA-6WGJ-66M2-XXP2...