CVE-2023-28858

low-risk
Published 2023-03-26

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.

Do I need to act?

~
1.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Redis-Py

Affected Vendors

Redis

References (12)

Patch https://github.com/redis/redis-py/compare/v4.3.5...v4.3.6
Patch https://github.com/redis/redis-py/compare/v4.4.2...v4.4.3
Patch https://github.com/redis/redis-py/compare/v4.5.2...v4.5.3
Issue Tracking https://github.com/redis/redis-py/issues/2624
Issue Tracking https://github.com/redis/redis-py/pull/2641
Third Party Advisory https://openai.com/blog/march-20-chatgpt-outage
Patch https://github.com/redis/redis-py/compare/v4.3.5...v4.3.6
Patch https://github.com/redis/redis-py/compare/v4.4.2...v4.4.3
Patch https://github.com/redis/redis-py/compare/v4.5.2...v4.5.3
Issue Tracking https://github.com/redis/redis-py/issues/2624
Issue Tracking https://github.com/redis/redis-py/pull/2641
Third Party Advisory https://openai.com/blog/march-20-chatgpt-outage
22
/ 100
low-risk
Severity 13/34 · Low
Exploitability 4/34 · Minimal
Exposure 5/34 · Minimal