CVE-2023-28859: Medium severity redis vulnerability
redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.
Other sources
redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-28859.
What is the severity of CVE-2023-28859?
The severity of CVE-2023-28859 is medium.
Which software versions are affected by CVE-2023-28859?
The software versions affected by CVE-2023-28859 are redis-py before 4.4.4 and 4.5.x before 4.5.4.
How can CVE-2023-28859 be fixed?
CVE-2023-28859 can be fixed by upgrading to redis-py version 4.4.4 or 4.5.4.
Where can I find more information about CVE-2023-28859?
You can find more information about CVE-2023-28859 at the following references: [link1], [link2], [link3].