CVE-2023-28859

一、漏洞信息
 漏洞编号：[CVE-2023-28859](https://nvd.nist.gov/vuln/detail/CVE-2023-28859)
 漏洞归属组件：[redis6](https://gitee.com/src-openeuler/redis6)
 漏洞归属的版本：6.0.11,6.2.7
 CVSS V3.0分值：
  BaseScore：6.5 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
 漏洞简述：
  redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.
 漏洞公开时间：2023-03-27 03:15:06
 漏洞创建时间：2023-03-27 22:07:49
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-28859
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/redis/redis-py/issues/2665 |  |
| cve.mitre.org | https://github.com/redis/redis-py/pull/2641 |  |
| cve.mitre.org | https://github.com/redis/redis-py/pull/2666 |  |
| cve.mitre.org | https://github.com/redis/redis-py/releases/tag/v4.4.4 |  |
| cve.mitre.org | https://github.com/redis/redis-py/releases/tag/v4.5.4 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28859 | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2182057 | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2182058 | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-28859 | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| suse_bugzilla | http://www.cvedetails.com/cve/CVE-2023-28858/ | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| suse_bugzilla | http://www.cvedetails.com/cve/CVE-2023-28859/ | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| suse_bugzilla | https://github.com/redis/redis-py/issues/2665 | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| suse_bugzilla | https://github.com/redis/redis-py/pull/2641 | https://bugzilla.suse.com/show_bug.cgi?id=1209812 |
| redhat_bugzilla | https://github.com/redis/redis-py/pull/2641 | https://bugzilla.redhat.com/show_bug.cgi?id=2182058 |
| redhat_bugzilla | https://github.com/redis/redis-py/issues/2665 | https://bugzilla.redhat.com/show_bug.cgi?id=2182058 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28859 | https://ubuntu.com/security/CVE-2023-28859 |
| ubuntu | https://github.com/redis/redis-py/pull/2641 | https://ubuntu.com/security/CVE-2023-28859 |
| ubuntu | https://github.com/redis/redis-py/issues/2665 | https://ubuntu.com/security/CVE-2023-28859 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-28859 | https://ubuntu.com/security/CVE-2023-28859 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-28859 | https://ubuntu.com/security/CVE-2023-28859 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-28859 | https://ubuntu.com/security/CVE-2023-28859 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-28859 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-28859 |
| cve_search |  | https://github.com/redis/redis-py/pull/2641 |
| cve_search |  | https://github.com/redis/redis-py/issues/2665 |
| cve_search |  | https://github.com/redis/redis-py/releases/tag/v4.4.4 |
| cve_search |  | https://github.com/redis/redis-py/releases/tag/v4.5.4 |
| cve_search |  | https://github.com/redis/redis-py/pull/2666 |
| github_advisory | https://nvd.nist.gov/vuln/detail/CVE-2023-28859 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/redis/redis-py/pull/1899 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/redis/redis-py/pull/2666 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/redis/redis-py/releases/tag/v4.4.4 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/pypa/advisory-database/tree/main/vulns/redis/PYSEC-2023-46.yaml | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/redis/redis-py/issues/2665 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/redis/redis-py/pull/2641 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/redis/redis-py/pull/2671 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| github_advisory | https://github.com/redis/redis-py/releases/tag/v4.5.4 | https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py/issues/2665 | https://osv.dev/vulnerability/CVE-2023-28859 |
| osv | https://github.com/redis/redis-py/pull/2641 | https://osv.dev/vulnerability/CVE-2023-28859 |
| osv | https://github.com/redis/redis-py/pull/2666 | https://osv.dev/vulnerability/CVE-2023-28859 |
| osv | https://github.com/redis/redis-py/releases/tag/v4.4.4 | https://osv.dev/vulnerability/CVE-2023-28859 |
| osv | https://github.com/redis/redis-py/releases/tag/v4.5.4 | https://osv.dev/vulnerability/CVE-2023-28859 |
| snyk | https://github.com/redis/redis-py/issues/2665 | https://security.snyk.io/vuln/SNYK-PYTHON-REDIS-5291196 |
| snyk | https://github.com/redis/redis-py/pull/2641 | https://security.snyk.io/vuln/SNYK-PYTHON-REDIS-5291196 |
| snyk | https://github.com/redis/redis-py/pull/2666 | https://security.snyk.io/vuln/SNYK-PYTHON-REDIS-5291196 |
| snyk | https://github.com/redis/redis-py/pull/2671 | https://security.snyk.io/vuln/SNYK-PYTHON-REDIS-5291196 |
| snyk | https://github.com/redis/redis-py/pull/2672 | https://security.snyk.io/vuln/SNYK-PYTHON-REDIS-5291196 |
| snyk | https://github.com/redis/redis-py/pull/2674 | https://security.snyk.io/vuln/SNYK-PYTHON-REDIS-5291196 |
| osv | https://nvd.nist.gov/vuln/detail/CVE-2023-28859 | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py/issues/2665 | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py/pull/2641 | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py/pull/2666 | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py/pull/2671 | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/pypa/advisory-database/tree/main/vulns/redis/PYSEC-2023-46.yaml | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py/releases/tag/v4.4.4 | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| osv | https://github.com/redis/redis-py/releases/tag/v4.5.4 | https://osv.dev/vulnerability/GHSA-8fww-64cx-x8p5 |
| nvd | https://github.com/redis/redis-py/pull/2641 |  |
| nvd | https://github.com/redis/redis-py/issues/2665 |  |
| nvd | https://github.com/redis/redis-py/releases/tag/v4.4.4 |  |
| nvd | https://github.com/redis/redis-py/releases/tag/v4.5.4 |  |
| nvd | https://github.com/redis/redis-py/pull/2666 |  |
| redhat | https://access.redhat.com/security/cve/CVE-2023-28859 |  |
| nvd | https://github.com/redis/redis-py/pull/2641 |  |
| nvd | https://github.com/redis/redis-py/issues/2665 |  |
| nvd | https://github.com/redis/redis-py/releases/tag/v4.4.4 |  |
| nvd | https://github.com/redis/redis-py/releases/tag/v4.5.4 |  |
| nvd | https://github.com/redis/redis-py/pull/2666 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | cve.mitre.org |
|  |  | https://github.com/redis/redis-py/pull/2666 |  | cve.mitre.org |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | suse_bugzilla |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | redhat_bugzilla |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | ubuntu |
|  |  | https://github.com/redis/redis-py/pull/1899 |  | github_advisory |
|  |  | https://github.com/redis/redis-py/pull/2666 |  | github_advisory |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | github_advisory |
|  |  | https://github.com/redis/redis-py/pull/2671 |  | github_advisory |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | osv |
|  |  | https://github.com/redis/redis-py/pull/2666 |  | osv |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | snyk |
|  |  | https://github.com/redis/redis-py/pull/2666 |  | snyk |
|  |  | https://github.com/redis/redis-py/pull/2671 |  | snyk |
|  |  | https://github.com/redis/redis-py/pull/2672 |  | snyk |
|  |  | https://github.com/redis/redis-py/pull/2674 |  | snyk |
|  |  | https://github.com/redis/redis-py/issues/2665 |  | nvd |
|  |  | https://github.com/redis/redis-py/pull/2641 |  | nvd |
|  |  | https://github.com/redis/redis-py/pull/2666 |  | nvd |
|  |  | https://github.com/redis/redis-py/releases/tag/v4.4.4 |  | nvd |
|  |  | https://github.com/redis/redis-py/releases/tag/v4.5.4 |  | nvd |
|  |  | https://github.com/redis/redis-py/pull/2671 |  | osv |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                                                                                                                                                                                                                                                                          
 openEuler评分：
  6.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(6.2.7):
2.openEuler-20.03-LTS-SP3(6.2.7):
3.openEuler-22.03-LTS(6.2.7):
4.openEuler-22.03-LTS-SP1(6.2.7):
5.openEuler-24.03-LTS(6.2.7):
6.master(6.2.7):
7.openEuler-22.03-LTS-SP4(6.2.7):

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(6.2.7):
2.openEuler-20.03-LTS-SP3(6.2.7):
3.openEuler-22.03-LTS(6.2.7):
4.openEuler-22.03-LTS-SP1(6.2.7):
5.openEuler-24.03-LTS(6.2.7):
6.master(6.2.7):
7.openEuler-22.03-LTS-SP4(6.2.7):

src-openEuler/redis6

内容风险标识

评论 (3)

src-openEuler/redis6 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-28859

评论 (3)

搜索帮助

src-openEuler/redis6