Data Leakage Vulnerability in Redis-py by Redis
CVE-2023-28859

6.5MEDIUM

Key Information:

Vendor

Redis

Status
Redis-py
Vendor
CVE Published:
26 March 2023

What is CVE-2023-28859?

The redis-py library versions prior to 4.4.4 and 4.5.x prior to 4.5.4 contain a vulnerability that occurs when an asynchronous Redis command is canceled improperly. This scenario can lead to the library leaving a connection open, resulting in response data from one command being sent to a client that is associated with a completely different request. This unintentional data crossover can pose serious risks, especially in environments where sensitive information is handled, highlighting the importance of upgrading to the patched versions to mitigate potential data leakage across AsyncIO connections.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/redis/redis-py/pull/2641
https://github.com/redis/redis-py/issues/2665
https://github.com/redis/redis-py/releases/tag/v4.4.4

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.