PyPI/redis CVE-2023-28858: unknown, EPSS 1.01%
redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send
Action: Upgrade redis to 4.3.6 or later.
pip install redis==4.3.6pip install redis==4.4.3pip install redis==4.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.2.0 | 4.3.6 | - |
| 4.4.0 | 4.4.3 | - |
| 4.5.0 | 4.5.3 | - |
Fixed versions
| 4.3.6 | 4.4.3 | 4.5.3 |
Sources
- osv: PYSEC-2023-45
- https://github.com/redis/redis-py/compare/v4.3.5...v4.3.6
- https://github.com/redis/redis-py/pull/2641
- https://openai.com/blog/march-20-chatgpt-outage
- https://github.com/redis/redis-py/issues/2624
- https://github.com/redis/redis-py/compare/v4.4.2...v4.4.3
- https://github.com/redis/redis-py/compare/v4.5.2...v4.5.3
- https://github.com/advisories/GHSA-24wv-mv5m-xv4h
CVE-2023-28858 · published · modified · JSON