CVE-2023-28858
First published: Sun Mar 26 2023(Updated: )
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redis Redis-py | >=4.2.0<4.3.6 | |
| Redis Redis-py | >=4.4.0<4.4.3 | |
| Redis Redis-py | >=4.5.0<4.5.3 | |
| pip/redis | >=4.2.0<4.3.6 | 4.3.6 |
| pip/redis | >=4.5.0<4.5.3 | 4.5.3 |
| pip/redis | >=4.4.0<4.4.3 | 4.4.3 |
| >=4.2.0<4.3.6 | ||
| >=4.4.0<4.4.3 | ||
| >=4.5.0<4.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/redis/redis-py/compare/v4.3.5...v4.3.6
- https://github.com/redis/redis-py/compare/v4.4.2...v4.4.3
- https://github.com/redis/redis-py/compare/v4.5.2...v4.5.3
- https://github.com/redis/redis-py/issues/2624
- https://github.com/redis/redis-py/pull/2641
- https://openai.com/blog/march-20-chatgpt-outage
- https://nvd.nist.gov/vuln/detail/CVE-2023-28858
- https://github.com/redis/redis-py/releases/tag/v4.4.4
- https://github.com/redis/redis-py/releases/tag/v4.5.4
- https://github.com/redis/redis-py/commit/d56baeb683fc1935cfa343fa2eeb0fa9bd955283
- https://github.com/pypa/advisory-database/tree/main/vulns/redis/PYSEC-2023-45.yaml
- https://github.com/advisories/GHSA-24wv-mv5m-xv4h (Advisory)
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2023-28858.
What is the severity level of CVE-2023-28858?
The severity level of CVE-2023-28858 is low.
What is the affected software of CVE-2023-28858?
The affected software of CVE-2023-28858 is Redis Redis-py versions between 4.2.0 and 4.3.6, 4.4.0 and 4.4.3, and 4.5.0 and 4.5.3.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by canceling an async Redis command at an inopportune time and causing a connection to remain open, potentially allowing them to send response data to the client of an unrelated request.
Is there a fix available for CVE-2023-28858?
Yes, a fix is available for CVE-2023-28858 in version 4.5.3 of Redis-py.
- collector/nvd-index
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-24wv-mv5m-xv4h
- alias/CVE-2023-28858
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/redis
- canonical/redis redis-py
- version/redis redis-py/4.2.0
- version/redis redis-py/4.4.0
- version/redis redis-py/4.5.0
- package-manager/pip