GHSA-8fww-64cx-x8p5

Source
https://github.com/advisories/GHSA-8fww-64cx-x8p5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-8fww-64cx-x8p5/GHSA-8fww-64cx-x8p5.json
Aliases
Published
2023-03-26T21:30:23Z
Modified
2024-02-16T08:08:55.199331Z
Details

redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.

References

Affected packages

PyPI / redis

Package

Name
redis

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.5.0
Fixed
4.5.4

Affected versions

4.*

4.5.0
4.5.1
4.5.2
4.5.3

Ecosystem specific 

{
    "affected_functions": [
        "redis.asyncio.client.Pipeline"
    ]
}

PyPI / redis

Package

Name
redis

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.4.4

Affected versions

4.*

4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.4.0rc4
4.4.0
4.4.1
4.4.2
4.4.3

Ecosystem specific 

{
    "affected_functions": [
        "redis.asyncio.client.Pipeline"
    ]
}