| Package | Affected versions | Patched versions |
|---|---|---|
| redis | ≥ 4.2.0, < 4.3.6≥ 4.4.0, < 4.4.3≥ 4.5.0, < 4.5.3 | 4.3.64.4.34.5.3 |
| redis-py | ≥ 4.2.0, < 4.3.6≥ 4.4.0, < 4.4.3≥ 4.5.0, < 4.5.3 | 4.3.64.4.34.5.3 |
redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but are believed to be incomplete. CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free