Ray Insertion of Sensitive Information into Log File Vulnerability

A vulnerability exists in the Ray package, specifically in versions prior to 2.43.0, allowing for the unintentional logging of sensitive information, such as the Redis password. This issue arises when the password is passed as an argument and logging is enabled. The vulnerability could be exploited if the logs are accessible to an attacker who can reach the Redis instance.

Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure of the Redis password, potentially allowing an attacker to access the Redis instance and its data.

Reproduction

To reproduce this vulnerability, start the Ray Client server and pass the Redis password as an argument. Ensure that logging is enabled and that the Redis instance requires password authentication. If the logs are accessible, the password will be exposed in plain text.

Remediation

Users are advised to upgrade to Ray version 2.43.0 or later, and to rotate their Redis password.