Redis, an open source in-memory database, contains a vulnerability (CVE-2024-46981) in its Lua library commands that allows an authenticated user to execute a crafted Lua script to manipulate the garbage collector, which may result in remote code execution. The vulnerability affects Redis versions before 6.2.17, 7.2.7, and 7.4.2. Official patches have been released to fix this issue. Additionally, restricting the EVAL and EVALSHA commands via ACLs can mitigate the risk by preventing Lua script execution. Red Hat advisories confirm the vulnerability and provide updated packages for affected Red Hat Enterprise Linux distributions.

Successful exploitation of this vulnerability can lead to remote code execution on the Redis server by an authenticated user, posing a critical security risk. This could allow attackers to execute arbitrary code with the privileges of the Redis process, potentially compromising the host system. No known exploits in the wild have been reported at this time.

A fix is available in Redis versions 6.2.17, 7.2.7, and 7.4.2. Users should upgrade to these or later versions to remediate the vulnerability. As an interim mitigation, administrators can use Access Control Lists (ACL) to restrict or disable the EVAL and EVALSHA commands, thereby preventing execution of Lua scripts until the patch can be applied. Refer to the vendor advisories and update documentation for detailed patching instructions.