GHSA-24wv-mv5m-xv4h redis-py Race Condition vulnerability

• PyPI redis: >= 4.4.0, < 4.4.3 → fixed in 4.4.3 • PyPI redis: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • PyPI redis: >= 4.2.0, < 4.3.6 → fixed in 4.3.6

redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but are believed to be incomplete. CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.