redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but are believed to be incomplete. CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.
{ "nvd_published_at": "2023-03-26T19:15:00Z", "cwe_ids": [ "CWE-193" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-03-27T21:31:45Z" }