abmarl (>=0.2.0, <=0.2.2), aliby (0.1.16) +5 more potentially affected by CVE-2025-1979 via ray (1.4.0)

ray PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.0, =0.1.4, =1.3.0, =1.4.10, =2021.6.22.dev0, =2021.7.1.dev0 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

gym-jiminy-rllib (1.6.27), gym-recorder (>=0.0.2, <=0.0.3) +5 more potentially affected by CVE-2025-1979 via ray (1.4.1)

ray PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - gym-jiminy-rllib 1.6.27 - gym-recorder =0.0.2, =1.6.3, =2.1.41, =2021.7.21.dev0, =2021.7.30.dev0 - raylab 0.15.10 Source cves: CVE-2025-1979 Source...

biome-text (3.3.0), discern-reconstruction (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2025-1979 via ray (1.6.0)

ray PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - biome-text 3.3.0 - discern-reconstruction =0.1.0, =0.1.7, =0.0.3.dev0, =0.2.4, =1.3.0, =2.2.10 - raylab 0.16.1 Source cves: CVE-2025-1979 Source advisory:...

aisfx (0.0.0) potentially affected by CVE-2025-1979 via ray (1.7.0)

ray PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - aisfx 0.0.0 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

beta-rec (>=0.2.1, <=0.2.2), fluidexec (0.1.0rc0) +1 more potentially affected by CVE-2025-1979 via ray (0.8.5)

ray PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - beta-rec =0.2.1, =2.6.0, =2.7.0 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

deepcomp (>=1.0.0, <=1.0.1), hub (>=1.0.0a0, <=1.0.0a4) +3 more potentially affected by CVE-2025-1979 via ray (1.0.0)

ray PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - deepcomp =1.0.0, =1.0.0a0, =0.1.1.1, =2.0.1, =0.0.1, =0.0.9 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

abmarl (>=0.1.1, <=0.1.3), deepcomp (>=1.1.0, <=1.2.3) +5 more potentially affected by CVE-2025-1979 via ray (1.2.0)

ray PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.1.1, =1.1.0, =0.1.3, =0.15.7, =0.15.9 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

connector-db-tools (0.0.1), pdf2dataset (>=0.1.0, <=0.4.0a1) +1 more potentially affected by CVE-2025-1979 via ray (0.8.6)

ray PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - connector-db-tools 0.0.1 - pdf2dataset =0.1.0, =0.4.10, =0.4.11 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

smarts (>=0.4.2, <=0.4.6.post0), ultra-rl (>=0.1.0, <=0.1.1) potentially affected by CVE-2025-1979 via ray (0.8.3)

ray PYPI version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - smarts =0.4.2, =0.1.0, =0.1.1 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

opensoundscape (>=0.4.0, <=0.5.0), pdf2dataset (>=0.4.0, <=0.5.3) +3 more potentially affected by CVE-2025-1979 via ray (0.8.7)

ray PYPI version 0.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - opensoundscape =0.4.0, =0.4.0, =0.8.3, =0.1.0, =0.0.0, =0.1.4 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-1979 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

CVE-2025-1979

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

CVE-2025-1979

Summary: CVE-2025-1979 affects the Python package Ray prior to 2.43.0, where the Redis password can be logged in standard logging when the password is passed as an argument. This is exploitable if logging is enabled, Redis uses password authentication, and those logs are accessible to an attacker...

CVE-2025-1979

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

ablator (>=0.0.1b1, <=0.0.1b3), ablator-ken-test (0.0.1b2) +252 more potentially affected by CVE-2025-1979 via ray (>=0.5.0, <=2.42.1)

ray PYPI version =0.5.0, =0.0.1b1, =0.1.1, =0.0.3, =0.0.1, =0.1.16, =0.1.4, =0.2.1, =1.1.1, =0.20.5.dev13, =0.20.5.dev13, =0.42.5.dev2 - amesa-train-dev 0.42.5.dev2 and more Source cves: CVE-2025-1979 Source advisory: MEND:CVE-2025-1979...

CVE-2025-1979

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

RAY log information leakage vulnerability

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. A security vulnerability exists in versions of ray prior to 2.43.0 that stems from the insertion of sensitive information into a log file, which could lead to the disclosure of redis passwords...

PT-2025-9877

Name of the Vulnerable Software and Affected Versions ray versions prior to 2.43.0 Description The issue concerns the insertion of sensitive information into log files, specifically the redis password being logged in standard logging. This occurs when the redis password is passed as an argument...

CVE-2025-1979: Insertion of Sensitive Information into Log File

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

Race Condition

Overview ray is an A system for parallel and distributed Python that unifies the ML ecosystem. Affected versions of this package are vulnerable to Race Condition in multi-threaded environments, attackers exploiting concurrent access can trigger unexpected behavior in MetricsLogger methods,...