CVE-2023-28859
Medium
Description
redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Redis-py
PublishedMar 26, 2023
First seenMar 26, 2023
How to fix
Update
- redis redis-py4.4.4, 4.5.4 or later
- redis4.5.4, 4.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redis redis-py | 4.2.0 ≤ v < 4.4.4, 4.5.0 ≤ v < 4.5.4 | 4.4.4, 4.5.4 |
| redisPyPI | 4.5.0 ≤ v < 4.5.4, 4.2.0 ≤ v < 4.4.4 | 4.5.4, 4.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.