diff --git a/advisories/unreviewed/2023/11/GHSA-6wgj-66m2-xxp2/GHSA-6wgj-66m2-xxp2.json b/advisories/unreviewed/2023/11/GHSA-6wgj-66m2-xxp2/GHSA-6wgj-66m2-xxp2.json index 3b70b773c6c24..ce583c7d2bed4 100644 --- a/advisories/unreviewed/2023/11/GHSA-6wgj-66m2-xxp2/GHSA-6wgj-66m2-xxp2.json +++ b/advisories/unreviewed/2023/11/GHSA-6wgj-66m2-xxp2/GHSA-6wgj-66m2-xxp2.json @@ -1,19 +1,37 @@ { "schema_version": "1.4.0", "id": "GHSA-6wgj-66m2-xxp2", - "modified": "2024-10-28T18:31:38Z", + "modified": "2024-10-28T18:32:44Z", "published": "2023-11-28T09:30:26Z", "aliases": [ "CVE-2023-48022" ], - "details": "Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment", + "summary": "Arbitrary code execution in ray via jobs submission API", + "details": "Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.\n\nNOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ray" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -31,13 +49,26 @@ "type": "WEB", "url": "https://docs.ray.io/en/latest/ray-security/index.html" }, + { + "type": "PACKAGE", + "url": "https://github.com/ray-project/ray" + }, + { + "type": "WEB", + "url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild" + }, { "type": "WEB", "url": "https://www.vicarius.io/vsociety/posts/shadowray-cve-2023-48022-exploit" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/blog/initial-access-intelligence-august-2024" } ], "database_specific": { "cwe_ids": [ + "CWE-829", "CWE-918" ], "severity": "CRITICAL",