Executive brief
redis-py is a widely-used Python library for interacting with Redis, a popular in-memory data store used in applications like ChatGPT. A race condition in the async command implementation allows connections to enter an unsafe state when commands are cancelled at specific moments, causing response data from one request to be misrouted to unrelated subsequent requests. This can lead to data leakage between application instances sharing a connection.
Technical details
The vulnerability is an off-by-one race condition (CWE-193) in redis-py's async command handler. When an async Redis command is cancelled after being sent but before its response is fully received and parsed, the connection is left in an unsafe state. Subsequent commands on the same connection will read the response from the previous cancelled command instead of their own response, causing an off-by-one mismatch between requests and responses. The attack vector is network-based with high timing requirements (AC:H in CVSS 3.1). No authentication is required. An attacker with ability to influence command cancellation timing can cause response data leakage. The vulnerability was patched in versions 4.3.6, 4.4.3, and 4.5.3, though the fixes were incomplete and led to CVE-2023-28859.
Affected products
- Redis redis-py 4.2.0 through 4.3.5; 4.4.0 through 4.4.2; 4.5.0 through 4.5.2
Timeline
- 2023-03-17: disclosed: Issue reported in redis-py GitHub issue #2624
- 2023-03-26: advisory: GHSA-24wv-mv5m-xv4h and CVE-2023-28858 published
- 2023-03-27: patched: Fixed in versions 4.3.6, 4.4.3, and 4.5.3 (incomplete fixes)