This security advisory addresses a use-after-free vulnerability (CWE-416) in Redis server related to Lua scripting during master-replica synchronization. The flaw occurs when replicas have the replica-read-only setting disabled or can be disabled by an authenticated attacker, enabling exploitation that may lead to remote code execution. The vulnerability impacts Redis instances configured for write operations on replicas or with insufficient access control to prevent modification of replica-read-only. The advisory recommends maintaining replica-read-only enabled, disabling Lua scripting if unnecessary, and restricting network access to trusted clients. Red Hat provides updated Boost RPM packages as part of the Hardened Images update, but the advisory does not explicitly confirm a patch for Redis itself. The CVSS score is not provided, but the vulnerability is rated as high severity by Red Hat.

Successful exploitation of this use-after-free vulnerability can lead to remote code execution on Redis replicas that have replica-read-only disabled or modifiable by an attacker with authentication. This could compromise confidentiality, integrity, and availability of the affected Redis service. The impact includes potential unauthorized code execution, data corruption, and service disruption. The vulnerability requires low attacker privileges and no user interaction, increasing risk in improperly configured environments.

Red Hat's advisory recommends ensuring that Redis replicas have the replica-read-only setting enabled and that unauthorized users cannot modify this setting. If Lua scripting is not required, it should be disabled to reduce the attack surface. Additionally, network access to Redis instances should be restricted to trusted clients only. Configuration changes require restarting the Redis service, which will cause temporary service interruption. Patch status for Redis in Red Hat products is not explicitly confirmed; therefore, users should monitor Red Hat advisories for official fixes and apply recommended configuration mitigations in the meantime.