CVE-2023-28858: redis-py Race Condition vulnerability
3.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.81663%
CWE
Published
3/26/2023
Updated
10/25/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| redis | pip | >= 4.4.0, < 4.4.3 | 4.4.3 |
| redis | pip | >= 4.5.0, < 4.5.3 | 4.5.3 |
| redis | pip | >= 4.2.0, < 4.3.6 | 4.3.6 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper handling of async command cancellation in pipeline operations. The _send_command_parse_response function in redis/asyncio/client.py was identified as the core execution path where canceled async commands could leave connections in an inconsistent state. The race condition occurs when cancellation happens after command transmission but before response parsing, creating mismatched response sequencing. The commit d56baeb683fc added cancellation handling here, confirming this function's central role. CVE-2023-28858 specifically mentions this off-by-one response leakage scenario in async operations.