CVE-2023-6019: Ray Command Injection in cpu_profile Parameter
A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Other sources
A command injection exists in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.
Credit
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-6019?
CVE-2023-6019 is a vulnerability that allows remote attackers to execute arbitrary commands on the system running the Ray dashboard.
How severe is CVE-2023-6019?
CVE-2023-6019 is classified as critical with a severity value of 10.
What is the affected software for CVE-2023-6019?
The affected software for CVE-2023-6019 is Ray Project Ray.
How can I fix the CVE-2023-6019 vulnerability?
To fix the CVE-2023-6019 vulnerability, it is recommended to update to a patched version of Ray.
Where can I find more information about CVE-2023-6019?
You can find more information about CVE-2023-6019 at the following link: https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe