Critical Vulnerability in python-redis: Connection Leak and Data Leakage Risk
Summary
DEBIAN-CVE-2023-28858: redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. Affects python-redis versions < 5.2.1-1. Fixed in 5.2.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-redis is a popular Python client for Redis, a powerful in-memory data structure store used as a database, cache, and message broker. The library facilitates seamless interaction with Redis, allowing developers to perform various operations efficiently. However, a recent vulnerability has been identified that could compromise the integrity of data handling within applications using this library.
Vulnerability Detail
The vulnerability arises from redis-py versions before 4.5.3, which leave a connection open after canceling an async Redis command at an inappropriate time. This can lead to response data being sent to the client of an unrelated request due to an off-by-one error. The issue was initially reported in relation to ChatGPT, prompting the release of versions 4.3.6, 4.4.3, and 4.5.3 to alter the behavior of pipeline operations. However, it is crucial to note that this vulnerability can lead to data leakage across AsyncIO connections, as detailed in CVE-2023-28859.
How To Fix
Minimum fixed version
5.2.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using async commands that may lead to connection leaks until the package is updated. Additionally, ensure that your application handles Redis connections properly to minimize the risk of data leakage.
Conclusion
The identified vulnerability in python-redis poses a significant risk of data leakage due to improper handling of async commands. It is crucial for developers using this library to update to the latest patched version to safeguard their applications against potential data exposure.
See every vulnerability recorded for python-redis →
FAQ
Versions of python-redis prior to 5.2.1-1 are affected by this vulnerability.
The vulnerability can lead to data leakage, where response data from one request may be sent to another client, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, updating to the patched version of python-redis (5.2.1-1 or later) is the recommended permanent fix.
If an immediate update is not possible, consider implementing workarounds such as avoiding async commands that may lead to connection leaks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-redis.
