Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-31294
• redis/redis#8712
• redis/redis@46f4ebb
• redis/redis@6cbea7d
• https://security.netapp.com/advisory/ntap-20230814-0007