Ray has arbitrary code execution via jobs submission API
Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-48022US | critical9.8OT hoch | Exploit | ||
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ra… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://atlas.mitre.org/studies/AML.CS0023WEB
- https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0WEB
- https://console.vulncheck.com/cve/CVE-2023-48022WEB
- https://docs.ray.io/en/latest/ray-security/index.htmlWEB
- https://docs.ray.io/en/latest/ray-security/token-auth.htmlWEB
- https://github.com/advisories/GHSA-6wgj-66m2-xxp2ADVISORY
- https://github.com/advisories/GHSA-xg2h-7cxj-3gvhADVISORY
- https://github.com/honysyang/RayWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan