cassandra3 -- arbitrary code execution

Marcus Eriksson reports:

  When running Apache Cassandra with
  the following configuration:
  enable_user_defined_functions: true
  enable_scripted_user_defined_functions: true
  enable_user_defined_functions_threads: false
  it is possible for an attacker to execute arbitrary code on
  the host. The attacker would need to have enough permissions
  to create user defined functions in the cluster to be able
  to exploit this.