natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'cassandra-3.11' into cassandra-4.0

This commit is contained in:
Mick Semb Wever 2022-02-18 11:14:50 +01:00
parent f8b3f60dbe 593872cb28
commit 85fd49f2cf
No known key found for this signature in database
GPG Key ID: E91335D77E3E87CB
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -10,6 +10,7 @@ Merged from 3.0:
* Improve start up processing of Incremental Repair information read from system.repairs (CASSANDRA-17342)
4.0.2
* Extend operator control over the UDF threading model for CVE-2021-44521 (CASSANDRA-17352)
* Full Java 11 support (CASSANDRA-16894)
* Remove unused 'geomet' package from cqlsh path (CASSANDRA-17271)
* Removed unused 'cql' dependency (CASSANDRA-17247)

18
NEWS.txt
View File

@ -18,6 +18,24 @@ CASSANDRA-14092.txt file.
If you use or plan to use very large TTLS (10 to 20 years), read CASSANDRA-14092.txt
for more information.
PLEASE READ: CVE-2021-44521 SCRIPTED UDF SYSTEM ACCESS (CASSANDRA-17352)
------------------------------------------------------------------------
If you have enabled scripted UDFs and run without UDF threads in cassandra.yaml:
enable_user_defined_functions_threads: false
an attacker could access java.lang.System methods and execute arbitrary code on
the machine. Disabling UDF threads is still considered insecure and not recommended.
To continue running without UDF threads you will need to set:
allow_insecure_udfs: true
and if you need access to java.lang.System for existing UDFs, set:
allow_extra_insecure_udfs: true
GENERAL UPGRADING ADVICE FOR ANY VERSION
========================================