https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 00:05:57 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-01831 bdu:2023-01831 https://cve.radiocsirt.org/vuln/bdu:2023-01831 https://cve.radiocsirt.org/vuln/brew-iredis-cve-2023-28858 <p><strong>Affected:</strong> Homebrew: iredis</p> <p>redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but [are believed to be incomplete](https://github.com/redis/redis-py/issues/2665). CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.</p> <p><strong>Affected:</strong> Homebrew: iredis</p> <p>redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but [are believed to be incomplete](https://github.com/redis/redis-py/issues/2665). CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.</p> https://cve.radiocsirt.org/vuln/brew-iredis-cve-2023-28858 https://cve.radiocsirt.org/vuln/euvd-2026-218463 EUVD-2026-218463 https://cve.radiocsirt.org/vuln/euvd-2026-218463 https://cve.radiocsirt.org/vuln/fkie_cve-2023-28858 <p>redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.</p> <p>redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-28858 https://cve.radiocsirt.org/vuln/ghsa-24wv-mv5m-xv4h <p><strong>Affected:</strong> PyPI: redis</p> <p>redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but [are believed to be incomplete](https://github.com/redis/redis-py/issues/2665). CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.</p> <p><strong>Affected:</strong> PyPI: redis</p> <p>redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but [are believed to be incomplete](https://github.com/redis/redis-py/issues/2665). CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.</p> https://cve.radiocsirt.org/vuln/ghsa-24wv-mv5m-xv4h https://cve.radiocsirt.org/vuln/gsd-2023-28858 gsd-2023-28858 https://cve.radiocsirt.org/vuln/gsd-2023-28858 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12873-1 <p>python310-redis-4.5.4-1.1 on GA media</p> <p>python310-redis-4.5.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12873-1 https://cve.radiocsirt.org/vuln/pysec-2023-45 <p><strong>Affected:</strong> PyPI: redis</p> <p>redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3; however, CVE-2023-28859 is a separate vulnerability.</p> <p><strong>Affected:</strong> PyPI: redis</p> <p>redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3; however, CVE-2023-28859 is a separate vulnerability.</p> https://cve.radiocsirt.org/vuln/pysec-2023-45 https://cve.radiocsirt.org/vuln/suse-su-2024:1639-2 <p>Security update for python-arcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack, python-marshmallow, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-opentelemetry-sdk, python-opentelemetry-semantic-conventions, python-opentelemetry-test-utils, python-pycomposefile, python-pydash, python-redis, python-retrying, python-semver, python-sshtunnel, python-strictyaml, python-sure, python-vcrpy, python-xmltodict</p> <p>Security update for python-arcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack, python-marshmallow, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-opentelemetry-sdk, python-opentelemetry-semantic-conventions, python-opentelemetry-test-utils, python-pycomposefile, python-pydash, python-redis, python-retrying, python-semver, python-sshtunnel, python-strictyaml, python-sure, python-vcrpy, python-xmltodict</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1639-2 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-28858 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: python-redis, Ubuntu:25.10: python-redis, Ubuntu:26.04:LTS: python-redis</p> <p>redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: python-redis, Ubuntu:25.10: python-redis, Ubuntu:26.04:LTS: python-redis</p> <p>redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-28858 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0772 <p>Ein Angreifer kann mehrere Schwachstellen in redis-py ausnutzen, um Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in redis-py ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0772