CVE-2023-28858

Description

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.

How to fix CVE-2023-28858

To remediate CVE-2023-28858, upgrade the affected package to a fixed version below.

• —no fix listed
• —upgrade to 4.4.3 or later
• —upgrade to 4.3.6 or later

Is CVE-2023-28858 being exploited?

Low — EPSS is 1.5%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0
• >= 4.4.0, < 4.4.3
• >= 4.2.0, < 4.3.6, >= 4.4.0, < 4.4.3, >= 4.5.0, < 4.5.3

CVSS scores

References (14)

• ADVISORYgithub.com/advisories/GHSA-24wv-mv5m-xv4h
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-28858
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-28858
• PATCHgithub.com/redis/redis-py
• WEB