CVE-2023-28859

Published: Mar 26, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.

Affected (2)

Products: Redis: Redis Py

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redis Redis Py	From 4.2.0 to 4.4.4
Redis Redis Py	From 4.5.0 to 4.5.4

Related CWEs

Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

References (10)

https://github.com/redis/redis-py/issues/2665

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://github.com/redis/redis-py/pull/2641

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/redis/redis-py/pull/2666

Source: cve@mitre.org

Release Notes

https://github.com/redis/redis-py/releases/tag/v4.4.4

Source: cve@mitre.org

Release Notes

https://github.com/redis/redis-py/releases/tag/v4.5.4

Source: cve@mitre.org

Release Notes

https://github.com/redis/redis-py/issues/2665

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://github.com/redis/redis-py/pull/2641

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://github.com/redis/redis-py/pull/2666

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/redis/redis-py/releases/tag/v4.4.4

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/redis/redis-py/releases/tag/v4.5.4

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

Timeline

No history available yet.