- Description
- redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.
- Source
- cve@mitre.org
- NVD status
- Modified
CVSS 3.1
- Type
- Primary
- Base score
- 3.7
- Impact score
- 1.4
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity
- LOW
- nvd@nist.gov
- CWE-193
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redis:redis-py:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01B96893-5078-47C0-A2F2-D1039A45152D",
"versionEndExcluding": "4.3.6",
"versionStartIncluding": "4.2.0"
},
{
"criteria": "cpe:2.3:a:redis:redis-py:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4512975-5839-4179-9B9E-526526E02C6F",
"versionEndExcluding": "4.4.3",
"versionStartIncluding": "4.4.0"
},
{
"criteria": "cpe:2.3:a:redis:redis-py:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5782D240-CF0F-41B0-9A06-47DD9E51C075",
"versionEndExcluding": "4.5.3",
"versionStartIncluding": "4.5.0"
}
],
"operator": "OR"
}
]
}
]