Vulnerability	Vulnerable Version
M Insertion of Sensitive Information into Log File ray is an A system for parallel and distributed Python that unifies the ML ecosystem. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only exploitable if: Logging is enabled; Redis is using password authentication; Those logs are accessible to an attacker, who can reach that redis instance. Note: It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password. How to fix Insertion of Sensitive Information into Log File? Upgrade `ray` to version 2.43.0 or higher.	[,2.43.0)
H Race Condition ray is an A system for parallel and distributed Python that unifies the ML ecosystem. Affected versions of this package are vulnerable to Race Condition in multi-threaded environments, attackers exploiting concurrent access can trigger unexpected behavior in `MetricsLogger` methods, including `peek` and `_del_key`, leading to inaccurate metric reporting and data corruption. How to fix Race Condition? Upgrade `ray` to version 2.42.0 or higher.	[,2.42.0)
M Race Condition ray is an A system for parallel and distributed Python that unifies the ML ecosystem. Affected versions of this package are vulnerable to Race Condition during the creation of actors in multi-threaded environments. How to fix Race Condition? Upgrade `ray` to version 2.11.0 or higher.	[,2.11.0)

Go back to all versions of this package