redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-28859
• redis/redis-py#2665
• redis/redis-py#2641
• redis/redis-py#2666
• redis/redis-py#2671
• https://github.com/redis/redis-py/releases/tag/v4.4.4
• https://github.com/redis/redis-py/releases/tag/v4.5.4
• https://github.com/pypa/advisory-database/tree/main/vulns/redis/PYSEC-2023-46.yaml
• redis/redis-py#1899
• redis/redis-py@66a4d6b
• redis/redis-py@b3c89ac