natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added CVE-2021-44521 to CHANGES.txt, NEWS.txt 

patch by Erick Ramirez; reviewed by Marcus Eriksson, Mick Semb Wever for CASSANDRA-17388
This commit is contained in:
Erick Ramirez 2022-02-18 04:48:01 +00:00 committed by Mick Semb Wever
parent 63788661cb
commit 679740ff48
No known key found for this signature in database
GPG Key ID: E91335D77E3E87CB
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -5,6 +5,7 @@
3.0.26
* Extend operator control over the UDF threading model for CVE-2021-44521 (CASSANDRA-17352)
* Fix conversion from megabits to bytes in streaming rate limiter (CASSANDRA-17243)
* Upgrade logback to 1.2.9 (CASSANDRA-17204)
* Avoid race in AbstractReplicationStrategy endpoint caching (CASSANDRA-16673)

18
NEWS.txt
View File

@ -27,6 +27,24 @@ Logback has not been upgraded to avoid breaking deployments and customizations
based on older versions. If you are using vulnerable components you will need
to upgrade to a newer version of Logback or stop using the vulnerable components.
PLEASE READ: CVE-2021-44521 SCRIPTED UDF SYSTEM ACCESS (CASSANDRA-17352)
------------------------------------------------------------------------
If you have enabled scripted UDFs and run without UDF threads in cassandra.yaml:
enable_user_defined_functions_threads: false
an attacker could access java.lang.System methods and execute arbitrary code on
the machine. Disabling UDF threads is still considered insecure and not recommended.
To continue running without UDF threads you will need to set:
allow_insecure_udfs: true
and if you need access to java.lang.System for existing UDFs, set:
allow_extra_insecure_udfs: true
GENERAL UPGRADING ADVICE FOR ANY VERSION
========================================