opensoundscape (>=0.4.0, <=0.5.0), pdf2dataset (>=0.4.0, <=0.5.3) +3 more potentially affected by CVE-2023-48022 +2 more via ray (0.8.7)

ray PYPI version 0.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - opensoundscape =0.4.0, =0.4.0, =0.8.3, =0.1.0, =0.0.0, =0.1.4 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory:...

opensoundscape (>=0.4.0, <=0.5.0), pdf2dataset (>=0.4.0, <=0.5.3) +3 more potentially affected by CVE-2023-6021 via ray (0.8.7)

ray PYPI version 0.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - opensoundscape =0.4.0, =0.4.0, =0.8.3, =0.1.0, =0.0.0, =0.1.4 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

modin (>=0.1.0, <=0.1.1) potentially affected by CVE-2023-6021 via ray (0.5.0)

ray PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin =0.1.0, =0.1.1 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

smarts (>=0.4.2, <=0.4.6.post0), ultra-rl (>=0.1.0, <=0.1.1) potentially affected by CVE-2023-48022 +2 more via ray (0.8.3)

ray PYPI version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - smarts =0.4.2, =0.1.0, =0.1.1 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

connector-db-tools (0.0.1), pdf2dataset (>=0.1.0, <=0.4.0a1) +1 more potentially affected by CVE-2023-6021 via ray (0.8.6)

ray PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - connector-db-tools 0.0.1 - pdf2dataset =0.1.0, =0.4.10, =0.4.11 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

smarts (>=0.4.2, <=0.4.6.post0), ultra-rl (>=0.1.0, <=0.1.1) potentially affected by CVE-2023-6021 via ray (0.8.3)

ray PYPI version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - smarts =0.4.2, =0.1.0, =0.1.1 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2023-48022 +2 more via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019...

auto-augment (1.0.0), bio-pyminer (>=0.9.13, <=0.10.0) +3 more potentially affected by CVE-2023-48022 +2 more via ray (0.8.4)

ray PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - auto-augment 1.0.0 - bio-pyminer =0.9.13, =0.0.0, =0.4.7, =0.4.9 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory:...

beta-rec (>=0.2.1, <=0.2.2), fluidexec (0.1.0rc0) +1 more potentially affected by CVE-2023-48022 +2 more via ray (0.8.5)

ray PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - beta-rec =0.2.1, =2.6.0, =2.7.0 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

encdecmeta (0.0.3), nevopy (>=0.0.1, <=0.2.3) potentially affected by CVE-2023-48022 +2 more via ray (1.1.0)

ray PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - encdecmeta 0.0.3 - nevopy =0.0.1, =0.2.3 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

deephyper (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-6021 via ray (0.7.2)

ray PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - deephyper =0.1.1, =0.1.2 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

connector-db-tools (0.0.1), pdf2dataset (>=0.1.0, <=0.4.0a1) +1 more potentially affected by CVE-2023-48022 +2 more via ray (0.8.6)

ray PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - connector-db-tools 0.0.1 - pdf2dataset =0.1.0, =0.4.10, =0.4.11 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory:...

modin (0.6.0) potentially affected by CVE-2023-6021 via ray (0.7.3)

ray PYPI version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin 0.6.0 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

modin (0.1.2) potentially affected by CVE-2023-48022 +2 more via ray (0.5.2)

ray PYPI version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin 0.1.2 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

mlsquare (0.2.1) potentially affected by CVE-2023-6021 via ray (0.6.5)

ray PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - mlsquare 0.2.1 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

mlsquare (0.2.1) potentially affected by CVE-2023-48022 +2 more via ray (0.6.5)

ray PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - mlsquare 0.2.1 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019 Source advisory: OSV:GHSA-H3XG-WV58-5P43...

flambe (>=0.4.11, <=0.4.13) potentially affected by CVE-2023-6021 via ray (0.7.6)

ray PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - flambe =0.4.11, =0.4.13 Source cves: CVE-2023-6021 Source advisory: OSV:GHSA-3PWW-QVR8-6MHP...

CVE-2023-6021

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019 Ray Command Injection in cpu_profile Parameter

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6019

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...