SB2022021112 - Remote code execution in Apache Cassandra

Description

This security bulletin contains information about 1 security vulnerability.

1) Security features bypass (CVE-ID: CVE-2021-44521)

The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists due to insecure configuration that allows arbitrary code execution if the following settings are applied:

enable_user_defined_functions: true
enable_scripted_user_defined_functions: true
enable_user_defined_functions_threads: false

Note, such configuration is considered insecure and as not default.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356
• http://www.openwall.com/lists/oss-security/2022/02/11/4