CVE-2023-28858: Low severity redis vulnerability
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.
Other sources
redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but are believed to be incomplete. CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2023-28858.
What is the severity level of CVE-2023-28858?
The severity level of CVE-2023-28858 is low.
What is the affected software of CVE-2023-28858?
The affected software of CVE-2023-28858 is Redis Redis-py versions between 4.2.0 and 4.3.6, 4.4.0 and 4.4.3, and 4.5.0 and 4.5.3.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by canceling an async Redis command at an inopportune time and causing a connection to remain open, potentially allowing them to send response data to the client of an unrelated request.
Is there a fix available for CVE-2023-28858?
Yes, a fix is available for CVE-2023-28858 in version 4.5.3 of Redis-py.