CVE-2023-28859

Name	CVE-2023-28859
Description	redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-redis (PTS)	jessie	2.10.1-1	fixed
	stretch	2.10.5-2	fixed
	buster	3.2.1-2	fixed
	bullseye	3.5.3-2	fixed
	bookworm	4.3.4-3	fixed
	sid, trixie	4.3.4-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-redis	source	(unstable)	(not affected)

Notes

- python-redis <not-affected> (Incomplete fix for CVE-2023-28858 not applied)
https://github.com/redis/redis-py/issues/2665
https://github.com/redis/redis-py/pull/2641