PYSEC-2023-46

2023-03-2619:15:00

Google

osv.dev

0.001 Low

EPSS

Percentile

41.4%

JSON

redis-py through 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.

CPENameOperatorVersion
rediseq4.5.2
rediseq4.3.3
rediseq4.3.0
rediseq4.5.0
rediseq4.4.0rc1
rediseq4.3.1
rediseq4.3.5
rediseq4.2.0
rediseq4.3.2
rediseq4.2.2