GHSA-8ffc-79xg-29w8

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

Database specific

{
    "cwe_ids": [
        "CWE-732",
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-23T16:10:04Z",
    "nvd_published_at": "2022-02-11T13:15:00Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven

org.apache.cassandra:cassandra-all

Package

Name: org.apache.cassandra:cassandra-all; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cassandra/cassandra-all

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.26

Affected versions

0.*

0.7.0-rc4

0.7.0

0.7.1

0.7.2

0.7.3

0.7.4

0.7.5

0.7.6

0.7.6-2

0.7.7

0.7.8

0.7.9

0.7.10

0.8.0-beta1

0.8.0-beta2

0.8.0-rc1

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.8.7

0.8.8

0.8.9

0.8.10

1.*

1.0.0-beta1

1.0.0-rc1

1.0.0-rc2

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.1.0-beta1

1.1.0-beta2

1.1.0-rc1

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.1.10

1.1.11

1.1.12

1.2.0-beta1

1.2.0-beta2

1.2.0-beta3

1.2.0-rc1

1.2.0-rc2

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

1.2.12

1.2.13

1.2.14

1.2.15

1.2.16

1.2.17

1.2.18

1.2.19

2.*

2.0.0-beta1

2.0.0-beta2

2.0.0-rc1

2.0.0-rc2

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.1.0-beta1

2.1.0-beta2

2.1.0-rc1

2.1.0-rc2

2.1.0-rc3

2.1.0-rc4

2.1.0-rc5

2.1.0-rc6

2.1.0-rc7

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.18

2.1.19

2.1.20

2.1.21

2.1.22

2.2.0-beta1

2.2.0-rc1

2.2.0-rc2

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.2.18

2.2.19

3.*

3.0.0-alpha1

3.0.0-beta1

3.0.0-beta2

3.0.0-rc1

3.0.0-rc2

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.0.16

3.0.17

3.0.18

3.0.19

3.0.20

3.0.21

3.0.22

3.0.23

3.0.24

3.0.25

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8ffc-79xg-29w8/GHSA-8ffc-79xg-29w8.json"

org.apache.cassandra:cassandra-all

Package

Name: org.apache.cassandra:cassandra-all; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cassandra/cassandra-all

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.11.0

Fixed

3.11.12

Affected versions

3.*

3.11.0

3.11.1

3.11.2

3.11.3

3.11.4

3.11.5

3.11.6

3.11.7

3.11.8

3.11.9

3.11.10

3.11.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8ffc-79xg-29w8/GHSA-8ffc-79xg-29w8.json"

org.apache.cassandra:cassandra-all

Package

Name: org.apache.cassandra:cassandra-all; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cassandra/cassandra-all

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.0.2

Affected versions

4.*

4.0.0

4.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8ffc-79xg-29w8/GHSA-8ffc-79xg-29w8.json"