CVE-2025-1979
First published: Thu Mar 06 2025(Updated: )
Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only exploitable if: 1) Logging is enabled; 2) Redis is using password authentication; 3) Those logs are accessible to an attacker, who can reach that redis instance. **Note:** It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.
Credit: report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ray | <2.43.0 | |
| pip/ray | <2.43.0 | 2.43.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d
- https://github.com/ray-project/ray/issues/50266
- https://github.com/ray-project/ray/pull/50409
- https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212
- https://nvd.nist.gov/vuln/detail/CVE-2025-1979
- https://github.com/advisories/GHSA-w4rh-fgx7-q63m (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2025-23.yaml
Frequently Asked Questions
What is the severity of CVE-2025-1979?
CVE-2025-1979 is considered a high severity vulnerability due to the potential exposure of sensitive information, specifically redis passwords.
How do I fix CVE-2025-1979?
To mitigate CVE-2025-1979, upgrade to Ray version 2.43.0 or later, where the logging of sensitive information is addressed.
What type of vulnerability is CVE-2025-1979?
CVE-2025-1979 is classified as an information disclosure vulnerability because it allows sensitive data to be logged.
Which versions of Ray are affected by CVE-2025-1979?
Ray versions prior to 2.43.0 are affected by CVE-2025-1979 and are vulnerable to sensitive information logging.
What kind of sensitive information is exposed in CVE-2025-1979?
CVE-2025-1979 exposes redis passwords if they are passed as arguments in the logging process.
- agent/first-publish-date
- agent/weakness
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/severity
- agent/author
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- agent/references
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- source/GitHub
- alias/GHSA-w4rh-fgx7-q63m
- alias/CVE-2025-1979
- agent/tags
- collector/github-advisory-latest
- vendor/ray
- canonical/ray
- package-manager/pip