PYSEC-2023-312 - Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specificall

Severity: low · CVSS 3.1 · Published 2023-07-15

Technologies: redis (PyPI). Vendors: PyPI.

Executive brief

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Affected products

PyPI redis

Related threats

PYSEC-2023-73 - redis-7.0.10 was discovered to contain a segmentation violation.
PYSEC-2023-46 - redis-py through 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline
PYSEC-2023-45 - redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopport
PYSEC-2022-43162 - Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.