REDIS WARNS OF CRITICAL FLAW IMPACTING THOUSANDS OF INSTANCES

Summary from the TLDR InfoSec newsletter

The Redis security team has released patches for a new critical (CVSS 10/10) vulnerability that could allow attackers to gain remote code execution. The vulnerability is caused by a 13-year-old use-after-free vulnerability that can be exploited by authenticated threat actors using a specially crafted Lua script. Redis recommends that administrators patch their servers and, to secure their instances further, they can enable authentication, disable Lua scripting and other unnecessary commands, launch Redis as a non-root user, and enable Redis logging.