redis-py Race Condition due to incomplete fix

中危 6.5CVE-2023-28859 · GHSA-8fww-64cx-x8p5 · PYSEC-2023-46 · Published 26/03/2023 · updated 17/06/2026

要点

CVE-2023-28859 是影响 redis, redis-py (redis) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.0%，高于 63.9% 的漏洞。
修复：升级到 4.4.4, 4.5.4 或更高版本。

Package	Affected versions	Patched versions
redis PyPI	`≥ 4.2.0, < 4.4.4≥ 4.5.0, < 4.5.4`	`4.4.44.5.4`
redis-py redis	`≥ 4.2.0, < 4.4.4≥ 4.5.0, < 4.5.4`	`4.4.44.5.4`

Description

redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.

NVD description

redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.

References

nvd.nist.gov/vuln/detail/CVE-2023-28859 · ADVISORY
redis/redis-py · WEB
redis/redis-py#1899 · WEB
redis/redis-py#2641 · WEB
redis/redis-py#2666 · WEB
redis/redis-py#2671 · WEB
redis/redis-py commit 66a4d6b · WEB
redis/redis-py commit b3c89ac · WEB
pypa/advisory-database · WEB
redis/redis-py · PACKAGE
redis/redis-py release v4.4.4 · WEB
redis/redis-py release v4.5.4 · WEB
GitHub Advisory GHSA-8fww-64cx-x8p5

redis 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

redis

PyPI

≥ 4.2.0, < 4.4.4≥ 4.5.0, < 4.5.4

4.4.44.5.4

redis-py

redis

≥ 4.2.0, < 4.4.4≥ 4.5.0, < 4.5.4

4.4.44.5.4

Description

NVD description