redis-py Race Condition vulnerability

THẤP 3.7CVE-2023-28858 · GHSA-24wv-mv5m-xv4h · PYSEC-2023-45 · Công bố 26/03/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-28858 là lỗ hổng mức THẤP (CVSS 3.7) ảnh hưởng redis, redis-py (redis).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 63.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.3.6, 4.4.3, 4.5.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
redis PyPI	`≥ 4.2.0, < 4.3.6≥ 4.4.0, < 4.4.3≥ 4.5.0, < 4.5.3`	`4.3.64.4.34.5.3`
redis-py redis	`≥ 4.2.0, < 4.3.6≥ 4.4.0, < 4.4.3≥ 4.5.0, < 4.5.3`	`4.3.64.4.34.5.3`

Mô tả

redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but are believed to be incomplete. CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.

Mô tả của NVD

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.