Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-1979

CVE-2025-1979:
ray vulnerable to Insertion of Sensitive Information into Log File

6.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-1979
GHSA ID
GHSA-w4rh-fgx7-q63m
EPSS Score
0.05978%
CWE
CWE-532
Published
3/6/2025
Updated
3/6/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
raypip< 2.43.02.43.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the logging statement in the main() function of server.py. The commit diff shows the vulnerable line was directly logging the 'args' object, which included redis_password. The patch explicitly redacts redis_password by replacing it with '****' before logging. The GitHub issue (#50266) and CVE description both confirm this line as the exposure point. The function's direct interaction with argument logging and credential handling makes this identification unambiguous.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

V*rsions o* t** p**k*** r*y ***or* *.**.* *r* vuln*r**l* to Ins*rtion o* S*nsitiv* In*orm*tion into Lo* *il* w**r* t** r**is p*sswor* is **in* lo**** in t** st*n**r* lo**in*. I* t** r**is p*sswor* is p*ss** *s *n *r*um*nt, it will ** lo**** *n* *oul*

Reasoning

T** vuln*r**ility st*ms *rom t** lo**in* st*t*m*nt in t** m*in() *un*tion o* s*rv*r.py. T** *ommit *i** s*ows t** vuln*r**l* lin* w*s *ir**tly lo**in* t** '*r*s' o*j**t, w*i** in*lu*** r**is_p*sswor*. T** p*t** *xpli*itly r****ts r**is_p*sswor* *y r*