CVE-2023-48023

Advisory

Ray 2.8.1 includes a fix for CVE-2023-48023: Anyscale Ray 2.6.3 and 2.8.0 allows SSRF through /log_proxy.
NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Release Highlights
The Ray 2.8.1 patch release contains fixes for the Ray Dashboard.

Additional context can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Ray Dashboard
🔨 Fixes:

[core][state][log] Cherry pick changes to prevent state API from reading files outside the Ray log directory (41520)
[Dashboard] Migrate Logs page to use state api. (41474) (41522)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48023
• https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0
• https://docs.ray.io/en/latest/ray-security/index.html
• https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023