redis-py Race Condition vulnerability

[catalinm-am]

redis-py before 4.5.3, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner.

The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but redis/redis-py#2665. GHSA-8fww-64cx-x8p5 has been assigned the issues caused by the incomplete fixes.

Possible Solution

Update version of redis from 4.2.2 to 4.3.6, 4.4.3, or 4.5.3.

[felixwang9817]

closing this as we have upgraded to 4.4.4 in #3604