CVE-2023-6019: critical vulnerability in ray-project/ray
Ray Command Injection in cpu_profile Parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
85Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.8epss 75%
from disclosure to weapon146 days
Published on NVDNov 16
1st PoC+146d
metasploitNov 15
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
2 products (47 components) — because the vulnerable code is not present in the product
Red Hat OpenShift AI (RHOAI) · Red Hat AI Inference Server
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ray-project · ray-project/raypublic PoCs found — 5
exploitdbwww.exploit-db.com/exploits/51978unverifiedgithubgithub.com/joaquinrrr/CVE-2023-6019★ 6githubgithub.com/Clydeston/CVE-2023-6019★ 2githubgithub.com/FireWolfWang/CVE-2023-6019★ 1githubgithub.com/Zohaibkhan1472/cve-2023-6019★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ray-project/ray
In the same product, most dangerous first.