Non notée
CVE-2021-44521 When running Apache Cassandra with the following configuration: enable_user_defined_functions: true…
Description
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Cassandra 4.0 | premières → dernières | 4.0.2 |
| Apache Cassandra 3.11 | premières → < 3.11.12 | 3.11.12 |
| Apache Cassandra 3.1 | 3.1 → dernières | Pas de correctif indiqué |
| Apache Cassandra 3.0 | premières → dernières | 3.0.26 |
Références
- lists.apache.org lists.apache.org
- [oss-security] 20220211 CVE-2021-44521: Apache Cassandra: Remote code execution for scripted UDFs www.openwall.com
- jfrog.com jfrog.com
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Cassandra
Les 10 CVE de Apache Cassandra →
CVE-2026-32588
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via…
Non notée
CVE-2026-27315
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from…
Non notée
CVE-2026-27314
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only…
Non notée
CVE-2025-26467
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Non notée