redis-py before 4.5.3, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner.
The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but redis/redis-py#2665. GHSA-8fww-64cx-x8p5 has been assigned the issues caused by the incomplete fixes.
Possible Solution
Update version of redis from 4.2.2 to 4.3.6, 4.4.3, or 4.5.3.
redis-py before 4.5.3, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner.
The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but redis/redis-py#2665. GHSA-8fww-64cx-x8p5 has been assigned the issues caused by the incomplete fixes.
Possible Solution
Update version of redis from 4.2.2 to 4.3.6, 4.4.3, or 4.5.3.