Race condition in redis-py - CVE-2023-28859

Vulnerability identifier: #VU74188

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28859

CWE-ID: CWE-362

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a race condition. A remote attacker can exploit the race and gain unauthorized access to sensitive information on the system.

redis-py
Cloud Pak for Network Automation
IBM Cloud Pak for Watson AIOps
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
Python 3 Module
SUSE Package Hub 15
openSUSE Leap
Fix docs for client_kill_filter (#1584) Thanks\n @Andrew
Python 3.7 End
Geosearch test should use any
Update docs for multiple usernames for ACL DELUSER (#1595)\n Thanks @Andrew
Fix grammar of get param in set command
Fix client_kill_filter docs for skimpy
Normalize minid and maxlen docs (#1593) Thanks\n @Andrew
python311-pycomposefile
python311-opencensus-ext-threading
python311-opencensus-context
python311-fixedint
python311-fluidity-sm
python311-sshtunnel
python311-isodate
python311-javaproperties
python311-tabulate
python311-knack
python311-pathspec
python311-opencensus
python311-xmltodict
python311-scp
python311-httplib2
python311-wheel
python311-opentelemetry-semantic-conventions
python311-opentelemetry-test-utils
python311-httpretty
python311-Deprecated
python311-aiosignal
python311-requests-oauthlib
python311-frozenlist
python311-frozenlist-debuginfo
python-frozenlist-debugsource
python311-retrying
python311-websocket-client
python311-blinker
python311-strictyaml
python311-distro
python311-yarl
python-yarl-debugsource
python311-yarl-debuginfo
python311-pkginfo
python311-avro
python311-wrapt-debuginfo
python-wrapt-debugsource
python311-wrapt
python311-opentelemetry-sdk
python311-opentelemetry-api
python311-PyGithub
python311-jsondiff
python311-lexicon
python311-sure
python311-invoke
python311-sortedcontainers
python311-portalocker
python311-PyJWT
python311-Pygments
python311-fakeredis
python311-semver
python311-pyparsing
python311-Fabric
python311-oauthlib
python311-argcomplete
python-paramiko-doc
python311-paramiko
python311-asgiref
python311-aiohttp
python311-aiohttp-debuginfo
python-aiohttp-debugsource
python311-zipp
python311-marshmallow
python311-async_timeout
python311-typing_extensions
python311-antlr4-python3-runtime
python-tqdm-bash-completion
python311-tqdm
python311-redis
python311-decorator
python311-chardet
python311-psutil
python311-psutil-debuginfo
python-psutil-debugsource
python311-vcrpy
python311-pydash
python311-multidict-debuginfo
python311-multidict
python-multidict-debugsource
python-zope.interface-debugsource
python311-zope.interface-debuginfo
python311-zope.interface
python311-importlib-metadata
python311-docker
python311-humanfriendly
python311-constantly
python311-hyperlink
python311-pip
python311-Automat
python311-incremental
python311-Twisted-all_non_platform
python311-Twisted-tls
python311-Twisted-http2
python311-Twisted-conch_nacl
python311-Twisted
python311-Twisted-conch
python311-Twisted-serial
python311-Twisted-contextvars
python311-service_identity
Dell EMC VxRail Appliance

Install updates from vendor's website.

redis-py - addressed in versions 4.4.4, 4.5.4
Fix docs for client_kill_filter (#1584) Thanks\n @Andrew - update to Chen-Wang
Python 3.7 End - update to of-Life
Geosearch test should use any - update to Chen-Wang
Update docs for multiple usernames for ACL DELUSER (#1595)\n Thanks @Andrew - update to Chen-Wang
Fix grammar of get param in set command - update to Chen-Wang
Fix client_kill_filter docs for skimpy - update to Chen-Wang
Normalize minid and maxlen docs (#1593) Thanks\n @Andrew - update to Chen-Wang
python311-pycomposefile - update to 0.0.30-150400.9.3.1
python311-opencensus-ext-threading - update to 0.1.2-150400.10.6.1
python311-opencensus-context - update to 0.1.3-150400.10.6.1
python311-fixedint - update to 0.2.0-150400.9.3.1
python311-fluidity-sm - update to 0.2.0-150400.10.7.2
python311-sshtunnel - update to 0.4.0-150400.5.4.4
python311-isodate - update to 0.6.1-150400.12.7.2
python311-javaproperties - update to 0.8.1-150400.10.4.4
python311-tabulate - update to 0.9.0-150400.11.7.4
python311-knack - update to 0.11.0-150400.10.4.4
python311-pathspec - update to 0.11.1-150400.9.7.2
python311-opencensus - update to 0.11.4-150400.10.6.3
python311-xmltodict - update to 0.13.0-150400.12.4.1
python311-scp - update to 0.14.5-150400.12.7.4
python311-httplib2 - update to 0.22.0-150400.10.4.1
python311-wheel - update to 0.40.0-150400.13.7.4
python311-opentelemetry-semantic-conventions - update to 0.44b0-150400.9.3.1
python311-opentelemetry-test-utils - update to 0.44b0-150400.9.3.1
python311-httpretty - update to 1.1.4-150400.11.4.1
python311-Deprecated - update to 1.2.14-150400.10.7.2
python311-aiosignal - update to 1.3.1-150400.9.7.2
python311-requests-oauthlib - update to 1.3.1-150400.12.7.1
python311-frozenlist - update to 1.3.3-150400.9.7.2
python311-frozenlist-debuginfo - update to 1.3.3-150400.9.7.2
python-frozenlist-debugsource - update to 1.3.3-150400.9.7.2
python311-retrying - update to 1.3.4-150400.12.4.1
python311-websocket-client - update to 1.5.1-150400.13.7.1
python311-blinker - update to 1.6.2-150400.12.7.4
python311-strictyaml - update to 1.7.3-150400.9.3.4
python311-distro - update to 1.9.0-150400.12.4.1
python311-yarl - update to 1.9.2-150400.8.7.4
python-yarl-debugsource - update to 1.9.2-150400.8.7.4
python311-yarl-debuginfo - update to 1.9.2-150400.8.7.4
python311-pkginfo - update to 1.9.6-150400.7.7.1
python311-avro - update to 1.11.3-150400.10.4.1
python311-wrapt-debuginfo - update to 1.15.0-150400.12.7.1
python-wrapt-debugsource - update to 1.15.0-150400.12.7.1
python311-wrapt - update to 1.15.0-150400.12.7.1
python311-opentelemetry-sdk - update to 1.23.0-150400.9.3.1
python311-opentelemetry-api - update to 1.23.0-150400.10.7.1
python311-PyGithub - update to 1.57-150400.10.4.4
python311-jsondiff - update to 2.0.0-150400.10.4.1
python311-lexicon - update to 2.0.1-150400.10.7.1
python311-sure - update to 2.0.1-150400.12.4.4
python311-invoke - update to 2.1.2-150400.10.7.4
python311-sortedcontainers - update to 2.4.0-150400.8.7.4
Cloud Pak for Network Automation - update to 2.4.7
python311-portalocker - update to 2.7.0-150400.10.7.4
python311-PyJWT - update to 2.8.0-150400.8.7.2
python311-Pygments - update to 2.15.1-150400.7.7.4
python311-fakeredis - update to 2.21.0-150400.9.3.4
python311-semver - update to 3.0.2-150400.10.4.1
python311-pyparsing - update to 3.0.9-150400.5.7.4
python311-Fabric - update to 3.2.2-150400.10.4.1
python311-oauthlib - update to 3.2.2-150400.12.7.4
python311-argcomplete - update to 3.3.0-150400.12.12.2
python-paramiko-doc - update to 3.4.0-150400.13.10.4
python311-paramiko - update to 3.4.0-150400.13.10.4
python311-asgiref - update to 3.6.0-150400.9.7.3
python311-aiohttp - update to 3.9.3-150400.10.18.4
python311-aiohttp-debuginfo - update to 3.9.3-150400.10.18.4
python-aiohttp-debugsource - update to 3.9.3-150400.10.18.4
python311-zipp - update to 3.15.0-150400.10.7.1
python311-marshmallow - update to 3.20.2-150400.9.7.1
python311-async_timeout - update to 4.0.2-150400.10.7.2
IBM Cloud Pak for Watson AIOps - update to 4.2.0
python311-typing_extensions - update to 4.5.0-150400.3.9.1
python311-antlr4-python3-runtime - update to 4.13.1-150400.10.4.1
python-tqdm-bash-completion - update to 4.66.1-150400.9.7.4
python311-tqdm - update to 4.66.1-150400.9.7.4
python311-redis - update to 5.0.1-150400.12.4.4
python311-decorator - update to 5.1.1-150400.12.7.4
python311-chardet - update to 5.2.0-150400.13.7.2
python311-psutil - update to 5.9.5-150400.6.9.4
python311-psutil-debuginfo - update to 5.9.5-150400.6.9.4
python-psutil-debugsource - update to 5.9.5-150400.6.9.4
python311-vcrpy - update to 6.0.1-150400.7.4.4
python311-pydash - update to 6.0.2-150400.9.4.1
python311-multidict-debuginfo - update to 6.0.4-150400.7.7.4
python311-multidict - update to 6.0.4-150400.7.7.4
python-multidict-debugsource - update to 6.0.4-150400.7.7.4
python-zope.interface-debugsource - update to 6.0-150400.12.7.4
python311-zope.interface-debuginfo - update to 6.0-150400.12.7.4
python311-zope.interface - update to 6.0-150400.12.7.4
python311-importlib-metadata - update to 6.8.0-150400.10.9.2
python311-docker - update to 7.0.0-150400.8.4.4
Dell EMC VxRail Appliance - update to 8.0.213
python311-humanfriendly - update to 10.0-150400.13.7.4
python311-constantly - update to 15.1.0-150400.12.7.2
python311-hyperlink - update to 21.0.0-150400.12.7.4
python311-pip - update to 22.3.1-150400.17.16.4
python311-Automat - update to 22.10.0-150400.3.7.2
python311-incremental - update to 22.10.0-150400.3.7.2
python311-Twisted-all_non_platform - update to 22.10.0-150400.5.17.4
python311-Twisted-tls - update to 22.10.0-150400.5.17.4
python311-Twisted-http2 - update to 22.10.0-150400.5.17.4
python311-Twisted-conch_nacl - update to 22.10.0-150400.5.17.4
python311-Twisted - update to 22.10.0-150400.5.17.4
python311-Twisted-conch - update to 22.10.0-150400.5.17.4
python311-Twisted-serial - update to 22.10.0-150400.5.17.4
python311-Twisted-contextvars - update to 22.10.0-150400.5.17.4
python311-service_identity - update to 23.1.0-150400.8.7.1

• https://github.com/redis/redis-py/pull/2641
• https://github.com/redis/redis-py/issues/2665
• https://github.com/redis/redis-py/releases/tag/v4.4.4
• https://github.com/redis/redis-py/releases/tag/v4.5.4
• https://github.com/advisories/GHSA-8fww-64cx-x8p5

• Race condition in redis-py
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• SUSE update for python-arcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, pyth
• SUSE update for python-arcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, pyth
• Multiple vulnerabilities in Dell EMC VxRail Appliance