CVE-2023-28858

2023-03-2619:15:06

Debian Security Bug Tracker

security-tracker.debian.org

0.001 Low

EPSS

Percentile

41.8%

JSON

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.

OSVersionArchitecturePackageVersionFilename
Debian12allpython-redis<= 4.3.4-3python-redis_4.3.4-3_all.deb
Debian11allpython-redis< 3.5.3-2python-redis_3.5.3-2_all.deb
Debian10allpython-redis< 3.2.1-2python-redis_3.2.1-2_all.deb
Debian999allpython-redis<= 4.3.4-3python-redis_4.3.4-3_all.deb
Debian13allpython-redis<= 4.3.4-3python-redis_4.3.4-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	python-redis	<= 4.3.4-3	python-redis_4.3.4-3_all.deb
Debian	11	all	python-redis	< 3.5.3-2	python-redis_3.5.3-2_all.deb
Debian	10	all	python-redis	< 3.2.1-2	python-redis_3.2.1-2_all.deb
Debian	999	all	python-redis	<= 4.3.4-3	python-redis_4.3.4-3_all.deb
Debian	13	all	python-redis	<= 4.3.4-3	python-redis_4.3.4-3_all.deb