CVE-2023-28859
📋 TL;DR
This vulnerability in redis-py allows data leakage across AsyncIO connections when async Redis commands are canceled at specific times. It affects applications using redis-py's async functionality, potentially exposing sensitive Redis data to unauthorized clients. The issue impacts both developers and end-users of affected applications.
💻 Affected Systems
- redis-py
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive Redis data (including authentication tokens, user data, or configuration secrets) could be exposed to unauthorized clients, leading to data breaches or privilege escalation.
Likely Case
Intermittent data leakage where response data from one client's request is sent to another client, potentially exposing non-sensitive operational data.
If Mitigated
With proper network segmentation and Redis authentication, impact is limited to data within the same security zone, though confidentiality may still be compromised.
🎯 Exploit Status
Exploitation requires timing conditions when canceling async commands, making reliable exploitation challenging but possible in controlled environments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.4 or 4.5.4
Vendor Advisory: https://github.com/redis/redis-py/releases/tag/v4.4.4
Restart Required: Yes
Instructions:
1. Identify redis-py version in your environment. 2. Upgrade to redis-py 4.4.4 or 4.5.4 using pip: 'pip install redis>=4.4.4' or 'pip install redis>=4.5.4'. 3. Restart all applications using redis-py. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable Async Operations
allTemporarily switch to synchronous Redis operations if async functionality is not required
Modify code to use synchronous Redis client instead of async client
Network Segmentation
allIsolate Redis instances from untrusted networks to limit exposure
Configure firewall rules to restrict Redis port (default 6379) access
🧯 If You Can't Patch
- Implement strict Redis authentication and access controls
- Monitor Redis connections for unusual patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check redis-py version in Python environment: 'python -c "import redis; print(redis.__version__)"'Check Version:
python -c "import redis; print('redis-py version:', redis.__version__)"Verify Fix Applied:
After upgrade, verify version is 4.4.4 or higher (or 4.5.4 or higher for 4.5.x series)📡 Detection & Monitoring
Log Indicators:
- Unexpected connection resets in Redis logs
- Multiple async command cancellations in short timeframes
Network Indicators:
- Unusual response patterns in Redis traffic
- Data responses sent to unexpected client IPs
SIEM Query:
source="redis.log" AND ("connection reset" OR "async cancel") | stats count by src_ip🔗 References
- https://github.com/redis/redis-py/issues/2665
- https://github.com/redis/redis-py/pull/2641
- https://github.com/redis/redis-py/pull/2666
- https://github.com/redis/redis-py/releases/tag/v4.4.4
- https://github.com/redis/redis-py/releases/tag/v4.5.4
- https://github.com/redis/redis-py/issues/2665
- https://github.com/redis/redis-py/pull/2641
- https://github.com/redis/redis-py/pull/2666
- https://github.com/redis/redis-py/releases/tag/v4.4.4
- https://github.com/redis/redis-py/releases/tag/v4.5.4
