A flaw was found in Redis before 4.0.10 and 5.x before 5.0 RC2. A buffer overflow in redis-cli allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line.

References: https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES https://gist.github.com/fakhrizulkifli/f831f40ec6cde4f744c552503d8698f0 https://www.exploit-db.com/exploits/44904/

Patch: https://github.com/antirez/redis/commit/9fdcc15962f9ff4baebe6fdd947816f43f730d50