Lucene search

PRIOn knowledge basePRION:CVE-2023-28858

HistoryMar 26, 2023 - 7:15 p.m.

Design/Logic Flaw

2023-03-2619:15:00

PRIOn knowledge base

www.prio-n.com

redis-py

design flaw

logic flaw

connection open

async command

off-by-one

data leakage

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.7%

JSON

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.

CPENameOperatorVersion
redis-pyge4.4.0
redis-pylt4.4.3
redis-pyge4.5.0
redis-pylt4.5.3
redis-pyge4.2.0
redis-pylt4.3.6

Name	Operator	Version
redis-py	ge	4.4.0
redis-py	lt	4.4.3
redis-py	ge	4.5.0
redis-py	lt	4.5.3
redis-py	ge	4.2.0
redis-py	lt	4.3.6

References

github.com/redis/redis-py/compare/v4.3.5...v4.3.6

github.com/redis/redis-py/compare/v4.4.2...v4.4.3

github.com/redis/redis-py/compare/v4.5.2...v4.5.3

github.com/redis/redis-py/issues/2624

github.com/redis/redis-py/pull/2641

openai.com/blog/march-20-chatgpt-outage