Critical Data Leakage Vulnerability in python-redis Package
Summary
UBUNTU-CVE-2023-28859: redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. Affects python-redis versions 4.3.4-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-redis package is a popular client library for interacting with Redis, a powerful in-memory data structure store. It is widely used for caching, session management, and real-time analytics due to its speed and efficiency. However, certain versions of this package are vulnerable to a critical issue that can lead to data leakage across AsyncIO connections, potentially exposing sensitive information to unauthorized clients.
Vulnerability Detail
The vulnerability, identified as CVE-2023-28859, affects redis-py versions before 4.4.4 and 4.5.x before 4.5.4. It arises when an async Redis command is canceled at an inappropriate time, leaving a connection open. This can result in response data being sent to the client of an unrelated request, leading to potential data leakage. The issue is particularly concerning in non-pipeline operations where multiple requests may be processed simultaneously. The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using async commands or ensure that commands are not canceled prematurely. This may help mitigate the risk of data leakage until the package can be updated to a secure version.
Conclusion
The python-redis package has a critical vulnerability that can lead to data leakage if not addressed. Users are strongly encouraged to update to the latest patched version to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for python-redis →
FAQ
CVE-2023-28859 is a vulnerability in the python-redis package that can lead to data leakage across AsyncIO connections.
The vulnerability affects redis-py versions before 4.4.4 and 4.5.x before 4.5.4.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing the suggested workaround by avoiding the use of async commands.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-redis.
