CVE-2024-31227: 
Redis vulnerability analysis and mitigation

Redis, an open-source in-memory database that persists on disk, disclosed a security vulnerability tracked as CVE-2024-31227. The vulnerability was discovered in Redis 7 prior to versions 7.2.6 and 7.4.1, where an authenticated user with sufficient privileges could create a malformed Access Control List (ACL) selector which, when accessed, triggers a server panic leading to a denial of service condition (Redis Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The issue stems from improper input validation (CWE-20) in the ACL selector mechanism. The vulnerability specifically involves the handling of malformed ACL selectors in the Redis server (Redis Advisory, NVD).

When exploited, this vulnerability can result in a denial of service condition through server panic. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Redis Advisory).

Users are advised to upgrade to Redis versions 7.2.6 or 7.4.1, which contain the fix for this vulnerability. There are no known workarounds for this vulnerability (NVD).