CVE-2024-46981

Name of the Vulnerable Software and Affected Versions Redis versions prior to 7.4.2 Redis versions prior to 7.2.7 Redis versions prior to 6.2.17

Description The issue is related to a use-after-free vulnerability in Redis, which can be exploited by manipulating the garbage collector using a specially crafted Lua script. This can potentially lead to remote code execution. An authenticated user may use this script to manipulate the garbage collector. The problem is fixed in versions 7.4.2, 7.2.7, and 6.2.17.

Recommendations For versions prior to 7.4.2, update to version 7.4.2 or later to resolve the issue. For versions prior to 7.2.7, update to version 7.2.7 or later to resolve the issue. For versions prior to 6.2.17, update to version 6.2.17 or later to resolve the issue. As a temporary workaround, consider preventing users from executing Lua scripts by restricting EVAL and EVALSHA commands using ACL to minimize the risk of exploitation.