PT-2025-9877 · Ray+1 · Ray+1

Letao Jiang · Published 2025-03-06 · Updated 2025-03-06 · CVE-2025-1979

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ray versions prior to 2.43.0

Description The issue concerns the insertion of sensitive information into log files, specifically the redis password being logged in standard logging. This occurs when the redis password is passed as an argument. The password could potentially leak if logs are accessible to an attacker. This is only exploitable if logging is enabled, Redis uses password authentication, and the logs are reachable by an attacker.

Recommendations For versions prior to 2.43.0, update to the latest version of Ray and then rotate the redis password. As a temporary workaround, consider disabling logging or restricting access to logs to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-1979

GHSA-W4RH-FGX7-Q63M

PYSEC-2025-23

Affected Products

Redis

Ray

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-1979 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-23 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1979 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w4rh-fgx7-q63m · Vendor Advisory
• https://github.com/ray-project/ray · Note
• https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d · Note
• https://github.com/ray-project/ray/issues/50266 · Note
• https://github.com/ray-project/ray/pull/50409 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2025-23.yaml · Note
• https://github.com/advisories/GHSA-w4rh-fgx7-q63m · Note
• https://twitter.com/CVEnew/status/1897539173726461988 · Twitter Post
• https://twitter.com/CVETracker/status/1897739145193148632 · Twitter Post
• https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212 · Note