GitHub Advisoryadvisory · Maven

GHSA-52gq-7j6c-xw6x Missing Authentication for Critical Function in Apache Cassandra

CRITICAL Published 2022-05-13 Modified 2024-03-04 Official page ↗
Aliases
CVE-2018-8016
Ecosystem
Maven
Packages
org.apache.cassandra:cassandra-all
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306
Reviewed
2022-06-29

Affected packages

• Maven org.apache.cassandra:cassandra-all: >= 3.8, < 3.11.2 → fixed in 3.11.2

Description

The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.

Related

Alias · CVE (1)

  • CVE-2018-8016 The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces,… vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References