autogluon (>=0.3.2b20211214, <=0.3.2b20220125), msapy (>=0.0.1, <=1.0.0) potentially affected by CVE-2023-48022 +2 more via ray (1.7.1)

ray PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - autogluon =0.3.2b20211214, =0.0.1, =1.0.0 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

actorch (>=0.0.3, <=0.0.5), aliby (>=0.1.18, <=0.1.55) +38 more potentially affected by CVE-2023-6021 via ray (1.13.0)

ray PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - actorch =0.0.3, =0.1.18, =0.1.11, =0.1.3, =0.4.3b20220618, =0.4.3b20220618, =0.4.3b20220618, =0.0.14, =11.1.0, =0.1.0, =0.2.0, =0.0.1, =0.0.9, =0.1.3 and...

aisfx (0.0.0) potentially affected by CVE-2023-48022 +2 more via ray (1.7.0)

ray PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - aisfx 0.0.0 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

gen2-connector (>=1.0.0b57, <=1.0.0b59), kserve (>=0.8.0rc0, <=0.8.0.2) +2 more potentially affected by CVE-2023-6021 via ray (1.9.0)

ray PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - gen2-connector =1.0.0b57, =0.8.0rc0, =0.0.2, =0.1.0, =0.1.2 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

hydra-ray-launcher (1.2.0), ray-on-aml (>=0.1.8, <=0.2.1) +1 more potentially affected by CVE-2023-6021 via ray (1.12.0)

ray PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - hydra-ray-launcher 1.2.0 - ray-on-aml =0.1.8, =0.2.1 - txp 0.2.17 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

pydgn (>=0.5.0, <=1.2.6), raylab (0.16.0) potentially affected by CVE-2023-6021 via ray (1.5.2)

ray PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - pydgn =0.5.0, =1.2.6 - raylab 0.16.0 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

gen2-connector (1.0.0b60), pynb-dag-runner (>=0.0.6, <=0.0.9) +2 more potentially affected by CVE-2023-6021 via ray (1.9.1)

ray PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - gen2-connector 1.0.0b60 - pynb-dag-runner =0.0.6, =0.0.4.dev1661688916, =0.0.4, =0.0.6 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

Ray OS Command Injection vulnerability

A command injection exists in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication...

GHSA-3PWW-QVR8-6MHP Ray Path Traversal vulnerability

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...

GHSA-H3XG-WV58-5P43 Ray OS Command Injection vulnerability

A command injection exists in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication...

beta-rec (>=0.2.1, <=0.2.2), fluidexec (0.1.0rc0) +1 more potentially affected by CVE-2023-6021 via ray (0.8.5)

ray PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - beta-rec =0.2.1, =2.6.0, =2.7.0 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

auto-augment (1.0.0), bio-pyminer (>=0.9.13, <=0.10.0) +3 more potentially affected by CVE-2023-6021 via ray (0.8.4)

ray PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - auto-augment 1.0.0 - bio-pyminer =0.9.13, =0.0.0, =0.4.7, =0.4.9 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

abmarl (>=0.1.1, <=0.1.3), deepcomp (>=1.1.0, <=1.2.3) +5 more potentially affected by CVE-2023-48022 +2 more via ray (1.2.0)

ray PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.1.1, =1.1.0, =0.1.3, =0.15.7, =0.15.9 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

modin (>=0.1.0, <=0.1.1) potentially affected by CVE-2023-48022 +2 more via ray (0.5.0)

ray PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin =0.1.0, =0.1.1 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

abmarl (>=0.1.1, <=0.1.3), deepcomp (>=1.1.0, <=1.2.3) +5 more potentially affected by CVE-2023-6021 via ray (1.2.0)

ray PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.1.1, =1.1.0, =0.1.3, =0.15.7, =0.15.9 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

modin (0.1.2) potentially affected by CVE-2023-6021 via ray (0.5.2)

ray PYPI version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin 0.1.2 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

encdecmeta (0.0.3), nevopy (>=0.0.1, <=0.2.3) potentially affected by CVE-2023-6021 via ray (1.1.0)

ray PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - encdecmeta 0.0.3 - nevopy =0.0.1, =0.2.3 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

biome-text (>=3.0.0, <=3.2.1), deepcomp (>=1.2.4, <=1.2.5) +7 more potentially affected by CVE-2023-48022 +2 more via ray (1.3.0)

ray PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - biome-text =3.0.0, =1.2.4, =0.4.2rc0, =0.0.7, =0.2.0, =2021.6.12.dev0, =2021.6.17.dev0 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source...

opensoundscape (>=0.4.0, <=0.5.0), pdf2dataset (>=0.4.0, <=0.5.3) +3 more potentially affected by CVE-2023-48022 +2 more via ray (0.8.7)

ray PYPI version 0.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - opensoundscape =0.4.0, =0.4.0, =0.8.3, =0.1.0, =0.0.0, =0.1.4 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory:...

opensoundscape (>=0.4.0, <=0.5.0), pdf2dataset (>=0.4.0, <=0.5.3) +3 more potentially affected by CVE-2023-6021 via ray (0.8.7)

ray PYPI version 0.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - opensoundscape =0.4.0, =0.4.0, =0.8.3, =0.1.0, =0.0.0, =0.1.4 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...