CVE-2023-28858

redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but are believed to be incomplete. CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.

TuxCare rebuilt redis to address 2 CVEs. Fixed in 4.5.1.post1+tuxcare.

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.

These are all security issues fixed in the python310-redis-4.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-redis-7.0.1-2.5 package on the GA media of openSUSE Tumbleweed.

redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3; however, CVE-2023-28859 is a separate vulnerability.

This update for python-argcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack, python-marshmallow, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-opentelemetry-sdk, python-opentelemetry-semantic-conventions, python-opentelemetry-test-utils, python-pycomposefile, python-pydash, python-redis, python-retrying, python-semver, python-sshtunnel, python-strictyaml, python-sure, python-vcrpy, python-xmltodict contains the following fixes:

Changes in python-argcomplete

• Update to 3.3.0 (bsc#1222880):

  • Preserve compatibility with argparse option tuples of length 4. This update is required to use argcomplete on Python 3.11.9+ or 3.12.3+.

• update to 3.2.3:

  • Allow register-python-argcomplete output to be used as lazy-loaded zsh completion module (#475)
    • Move debug_stream initialization to helper method to allow fd 9 behavior to be overridden in subclasses (#471)

• update to 3.2.2:

  • Expand tilde in zsh

• Remove coverage check

• Fix zsh test failures: avoid coloring terminal

• update to 3.2.1:

  • Allow explicit zsh global completion activation (#467)
  • Fix and test global completion in zsh (#463, #466)
  • Add –yes option to activate-global-python-argcomplete (#461)
  • Test suite improvements

• drop without_zsh.patch: obsolete

• update to 3.1.6:

  • Respect user choice in activate-global-python-argcomplete
  • Escape colon in zsh completions. Fixes #456
  • Call _default as a fallback in zsh global completion

• update to 3.1.4:

  • Call _default as a fallback in zsh global completion
  • zsh: Allow to use external script (#453)
  • Add support for Python 3.12 and drop EOL 3.6 and 3.7 (#449)
  • Use homebrew prefix by default
  • zsh: Allow to use external script (#453)

Changes in python-Fabric:

• Update to 3.2.2
• add fix-test-deps.patch to remove vendored dependencies *[Bug]: fabric.runners.Remote failed to properly deregister its SIGWINCH signal handler on shutdown; in rare situations this could cause tracebacks when the Python process receives SIGWINCH while no remote session is active. This has been fixed.

• [Bug] #2204: The signal handling functionality added in Fabric 2.6 caused unrecoverable tracebacks when invoked from inside a thread (such as the use of fabric.group.ThreadingGroup) under certain interpreter versions. This has been fixed by simply refusing to register signal handlers when not in the main thread. Thanks to Francesco Giordano and others for the reports.
• [Bug]: Neglected to actually add deprecated to our runtime dependency specification (it was still in our development dependencies). This has been fixed.
• [Feature]: Enhanced fabric.testing in ways large and small: Backwards-compatibly merged the functionality of MockSFTP into MockRemote (may be opted-into by instantiating the latter with enable_sftp=True) so you can mock out both SSH and SFTP functionality in the same test, which was previously impossible. It also means you can use this in a Pytest autouse fixture to prevent any tests from accidentally hitting the network! A new pytest fixture, remote_with_sftp, has been added which leverages the previous bullet point (an all-in-one fixture suitable for, eg, preventing any incidental ssh/sftp attempts during test execution). A pile of documentation and test enhancements (yes, testing our testing helpers is a thing).
• [Support]: Added a new runtime dependency on the Deprecated library.
• [Support]: Language update: applied s/sanity/safety/g to the codebase (with the few actual API members using the term now marked deprecated & new ones added in the meantime, mostly in fabric.testing).
• [Feature]: Add a new CLI flag…

This update for python-argcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack, python-marshmallow, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-opentelemetry-sdk, python-opentelemetry-semantic-conventions, python-opentelemetry-test-utils, python-pycomposefile, python-pydash, python-redis, python-retrying, python-semver, python-sshtunnel, python-strictyaml, python-sure, python-vcrpy, python-xmltodict contains the following fixes:

Changes in python-argcomplete

• Update to 3.3.0 (bsc#1222880):

  • Preserve compatibility with argparse option tuples of length 4. This update is required to use argcomplete on Python 3.11.9+ or 3.12.3+.

• update to 3.2.3:

  • Allow register-python-argcomplete output to be used as lazy-loaded zsh completion module (#475)
    • Move debug_stream initialization to helper method to allow fd 9 behavior to be overridden in subclasses (#471)

• update to 3.2.2:

  • Expand tilde in zsh

• Remove coverage check

• Fix zsh test failures: avoid coloring terminal

• update to 3.2.1:

  • Allow explicit zsh global completion activation (#467)
  • Fix and test global completion in zsh (#463, #466)
  • Add –yes option to activate-global-python-argcomplete (#461)
  • Test suite improvements

• drop without_zsh.patch: obsolete

• update to 3.1.6:

  • Respect user choice in activate-global-python-argcomplete
  • Escape colon in zsh completions. Fixes #456
  • Call _default as a fallback in zsh global completion

• update to 3.1.4:

  • Call _default as a fallback in zsh global completion
  • zsh: Allow to use external script (#453)
  • Add support for Python 3.12 and drop EOL 3.6 and 3.7 (#449)
  • Use homebrew prefix by default
  • zsh: Allow to use external script (#453)

Changes in python-Fabric:

• Update to 3.2.2
• add fix-test-deps.patch to remove vendored dependencies *[Bug]: fabric.runners.Remote failed to properly deregister its SIGWINCH signal handler on shutdown; in rare situations this could cause tracebacks when the Python process receives SIGWINCH while no remote session is active. This has been fixed.

• [Bug] #2204: The signal handling functionality added in Fabric 2.6 caused unrecoverable tracebacks when invoked from inside a thread (such as the use of fabric.group.ThreadingGroup) under certain interpreter versions. This has been fixed by simply refusing to register signal handlers when not in the main thread. Thanks to Francesco Giordano and others for the reports.
• [Bug]: Neglected to actually add deprecated to our runtime dependency specification (it was still in our development dependencies). This has been fixed.
• [Feature]: Enhanced fabric.testing in ways large and small: Backwards-compatibly merged the functionality of MockSFTP into MockRemote (may be opted-into by instantiating the latter with enable_sftp=True) so you can mock out both SSH and SFTP functionality in the same test, which was previously impossible. It also means you can use this in a Pytest autouse fixture to prevent any tests from accidentally hitting the network! A new pytest fixture, remote_with_sftp, has been added which leverages the previous bullet point (an all-in-one fixture suitable for, eg, preventing any incidental ssh/sftp attempts during test execution). A pile of documentation and test enhancements (yes, testing our testing helpers is a thing).
• [Support]: Added a new runtime dependency on the Deprecated library.
• [Support]: Language update: applied s/sanity/safety/g to the codebase (with the few actual API members using the term now marked deprecated & new ones added in the meantime, mostly in fabric.testing).
• [Feature]: Add a new CLI flag…