id: PYSEC-2025-23
modified: 2025-04-09T17:27:27.434099Z
published: 2025-03-06T05:15:16Z
aliases:
- CVE-2025-1979
- GHSA-w4rh-fgx7-q63m
details: "Versions of the package ray before 2.43.0 are vulnerable to Insertion of
  Sensitive Information into Log File where the redis password is being logged in
  the standard logging. If the redis password is passed as an argument, it will be
  logged and could potentially leak the password.\r\rThis is only exploitable if:\r
  \r1) Logging is enabled;\r\r2) Redis is using password authentication;\r\r3) Those
  logs are accessible to an attacker, who can reach that redis instance.\r\r**Note:**\r
  \rIt is recommended that anyone who is running in this configuration should update
  to the latest version of Ray, then rotate their redis password."
affected:
- package:
    ecosystem: PyPI
    name: ray
    purl: pkg:pypi/ray
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 64a2e4010522d60b90c389634f24df77b603d85d
    repo: https://github.com/ray-project/ray
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.43.0
  versions:
  - 0.1.1
  - 0.1.2
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.3.0
  - 0.3.1
  - 0.4.0
  - 0.5.0
  - 0.5.2
  - 0.5.3
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.6.4
  - 0.6.5
  - 0.6.6
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.7.7
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - 1.0.0
  - 1.0.0rc0
  - 1.0.0rc1
  - 1.0.0rc2
  - 1.0.1
  - 1.0.1.post1
  - 1.1.0
  - 1.10.0
  - 1.10.0rc0
  - 1.11.0
  - 1.11.0rc0
  - 1.11.0rc1
  - 1.11.1
  - 1.12.0
  - 1.12.0rc1
  - 1.12.1
  - 1.13.0
  - 1.2.0
  - 1.3.0
  - 1.4.0
  - 1.4.0rc1
  - 1.4.0rc2
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.6.0
  - 1.7.0
  - 1.7.0rc0
  - 1.7.1
  - 1.8.0
  - 1.9.0
  - 1.9.0rc1
  - 1.9.0rc2
  - 1.9.1
  - 1.9.1rc0
  - 1.9.2
  - 2.0.0
  - 2.0.0rc0
  - 2.0.0rc1
  - 2.0.1
  - 2.1.0
  - 2.10.0
  - 2.11.0
  - 2.12.0
  - 2.2.0
  - 2.20.0
  - 2.21.0
  - 2.22.0
  - 2.23.0
  - 2.24.0
  - 2.3.0
  - 2.3.0rc0
  - 2.3.1
  - 2.30.0
  - 2.31.0
  - 2.32.0
  - 2.32.0rc0
  - 2.33.0
  - 2.34.0
  - 2.35.0
  - 2.36.0
  - 2.36.1
  - 2.37.0
  - 2.38.0
  - 2.39.0
  - 2.4.0
  - 2.40.0
  - 2.41.0
  - 2.42.0
  - 2.42.1
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.7.0
  - 2.7.0rc0
  - 2.7.1
  - 2.7.2
  - 2.8.0
  - 2.8.1
  - 2.9.0
  - 2.9.1
  - 2.9.2
  - 2.9.3
references:
- type: FIX
  url: 
    https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d
- type: REPORT
  url: https://github.com/ray-project/ray/issues/50266
- type: WEB
  url: https://github.com/ray-project/ray/pull/50409
- type: WEB
  url: https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212
- type: ADVISORY
  url: https://github.com/advisories/GHSA-w4rh-fgx7-q63m