GHSA-w7f2-gjxf-2gm9
Improper Neutralization of Special Elements used in a Command in Apache Cassandra
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.cassandra:apache-cassandra | >= 1.2.0, < 2.0.14 | 2.0.14 |
| Maven | org.apache.cassandra:apache-cassandra | >= 2.1.0, < 2.1.4 | 2.1.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
References
External links from the advisory. They lead to third-party sites.