PyPI/ray CVE-2025-1979: medium 6.4, EPSS 0.20%
Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is
Action: Upgrade ray to 2.43.0 or later.
pip install ray==2.43.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.43.0 | - |
Fixed versions
| 2.43.0 |
Sources
- osv: PYSEC-2025-23
- nvd: CVE-2025-1979
- https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d
- https://github.com/ray-project/ray/issues/50266
- https://github.com/ray-project/ray/pull/50409
- https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212
- https://github.com/advisories/GHSA-w4rh-fgx7-q63m
CVE-2025-1979 · published · modified · JSON