CVE-2023-28859

Name of the Vulnerable Software and Affected Versions redis-py versions 4.4.0 through 4.4.3 redis-py versions 4.5.0 through 4.5.3

Description The issue is related to the redis-py library for Python, which is associated with a lack of protection for service data. This could allow a remote attacker to gain unauthorized access to protected information. The problem occurs when an async Redis command is canceled at an inopportune time, leaving a connection open and potentially sending response data to the client of an unrelated request, particularly in the case of non-pipeline operations.

Recommendations For redis-py versions 4.4.0 through 4.4.3, update to version 4.4.4 or later. For redis-py versions 4.5.0 through 4.5.3, update to version 4.5.4 or later.