Data Leakage Vulnerability in redis-py Package: CVE-2023-28858
Summary
CVE-2023-28858: redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. Affects python-redis versions >= ef4caf5b8bd55fc5c3ca7d994e2047e046f7e942, < 7b48b1bb34f97e4adf32c12a987ff593dc536aef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The redis-py package is a Python client for Redis, a powerful in-memory data structure store used as a database, cache, and message broker. It provides a simple interface for interacting with Redis, supporting various data types and operations. However, certain versions of redis-py are susceptible to a vulnerability that can lead to unintended data exposure.
Vulnerability Detail
CVE-2023-28858 affects redis-py versions prior to 4.5.3. The vulnerability arises when an async Redis command is canceled at an inappropriate time, leaving a connection open. This can result in response data from one request being sent to the client of an unrelated request due to an off-by-one error. This issue poses a risk of data leakage, potentially exposing sensitive information across different requests.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using async commands in a way that could lead to cancellation during critical operations. Ensure that commands are completed before canceling any ongoing requests.
Conclusion
CVE-2023-28858 presents a significant risk of data leakage in the redis-py package, particularly in versions prior to 4.5.3. It is crucial for users to update their packages to mitigate this vulnerability and ensure the security of their applications.
See every vulnerability recorded for python-redis →
FAQ
CVE-2023-28858 is a vulnerability in the redis-py package that can lead to data leakage due to improper handling of async command cancellations.
Versions of redis-py prior to 4.5.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2023-28858 is 3.7, indicating a moderate level of severity.
If an immediate update is not possible, consider implementing the suggested workaround by avoiding async command cancellations during critical operations.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-redis.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
