PYSEC-2023-45

2023-03-2619:15:00

Google

osv.dev

redis-py vulnerability

open connections

off-by-one

cve-2023-28859

software

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

45.7%

JSON

redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3; however, CVE-2023-28859 is a separate vulnerability.

CPENameOperatorVersion
rediseq4.2.0
rediseq4.3.2
rediseq4.2.1
rediseq4.5.0
rediseq4.3.5
rediseq4.5.2
rediseq4.2.2
rediseq4.3.4
rediseq4.4.0
rediseq4.3.0