Photon OS 5.0: Cassandra PHSA-2026-5.0-91-0958

An update of the cassandra package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0958. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Cassandra PHSA-2026-5.0-92-0958

An update of the cassandra package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0958. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-23015 vulnerabilities

Vulnerabilities for packages: stargate...

PT-2025-24459

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 3.0.30 Apache Cassandra versions 3.11.17 Apache Cassandra versions 4.0.16 Apache Cassandra versions 4.1.7 Apache Cassandra versions 5.0.2 Description: A privilege escalation issue exists in Apache Cassandra where a...

com.alvazan:playorm (1.6.1), com.datastax.cassandra:cassandra-driver-core (>=1.0.2, <=1.0.3-dse) +14 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (1.2.6)

org.apache.cassandra:cassandra-all MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.alvazan:playorm 1.6.1 - com.datastax.cassandra:cassandra-driver-core =1.0.2, =1.0.2,...

com.stratio.cassandra:cassandra-lucene-index-plugin (>=2.2.11.0, <=2.2.12.0) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.11)

org.apache.cassandra:cassandra-all MAVEN version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin =2.2.11.0, =2.2.12.0 Source cves:...

com.ericsson.bss.cassandra.ecaudit:ecaudit_c5.0 (>=3.1.0, <=3.1.1) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (>=5.0.0, <=5.0.2)

org.apache.cassandra:cassandra-all MAVEN version =5.0.0, =3.1.0, =3.1.1 Source cves: CVE-2025-23015 Source advisory: GHSA-WMCC-9VCH-JMX4...

com.netflix.astyanax:astyanax (>=3.10.0, <=3.10.1), com.netflix.astyanax:astyanax-cassandra (>=3.10.0, <=3.10.1) +12 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.0.17)

org.apache.cassandra:cassandra-all MAVEN version 2.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.netflix.astyanax:astyanax =3.10.0, =3.10.0, =3.10.0, =3.10.0, =3.10.0, =3.10.0, =3.10....

ai.grakn:grakn (>=0.13.0, <=0.14.0), ai.grakn:grakn-client (>=0.13.0, <=0.14.0) +28 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.17)

org.apache.cassandra:cassandra-all MAVEN version 2.1.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - ai.grakn:grakn =0.13.0, =0.13.0, =0.13.0, =0.13.0,...

de.nierbeck.cassandra:karaf-cassandra-embedded (1.0.0), org.hawkular.accounts:hawkular-accounts (1.0.17.final) +10 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.0)

org.apache.cassandra:cassandra-all MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - de.nierbeck.cassandra:karaf-cassandra-embedded 1.0.0 -...

com.ericsson.bss.cassandra.ecaudit:ecaudit_c4.1 (>=3.0.0, <=3.1.0), com.instaclustr:cassandra-ldap-4.1.0 (1.0.0) +17 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (>=4.1.0, <=4.1.6)

org.apache.cassandra:cassandra-all MAVEN version =4.1.0, =3.0.0, =4.1.0, =4.1.0, =4.1.0, =2.1.0-alpha-8, =0.13.0, =2.6.0, =2.10.0, =1.0-beta3, =3.15, =5.3 and more Source cves: CVE-2025-23015 Source advisory: GHSA-WMCC-9VCH-JMX4...

com.bazaarvoice.astyanax:astyanax-cassandra (>=3.8.0-bv8, <=3.8.0-bv9), com.bazaarvoice.astyanax:astyanax-contrib (>=3.8.0-bv8, <=3.8.0-bv9) +28 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.4)

org.apache.cassandra:cassandra-all MAVEN version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.bazaarvoice.astyanax:astyanax-cassandra =3.8.0-bv8, =3.8.0-bv8, =3.8.0-bv8, =3.8.0-bv8,...

org.codehaus.mojo:cassandra-maven-plugin (0.8.6-1) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (0.8.6)

org.apache.cassandra:cassandra-all MAVEN version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - org.codehaus.mojo:cassandra-maven-plugin 0.8.6-1 Source cves: CVE-2025-23015 Source advisor...

com.netflix.astyanax:astyanax (>=1.0.4, <=1.0.6), com.savoirtech.hecate:hecate-core (1.0.16) +4 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (1.1.0)

org.apache.cassandra:cassandra-all MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.netflix.astyanax:astyanax =1.0.4, =1.1-0, =3.1-05, =1.1-0, =1.1-2 Source cves:...

me.prettyprint:hector-core (>=0.7.0-29, <=0.7.0-31), me.prettyprint:hector-object-mapper (>=1.0-07, <=1.0-09) +2 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (0.7.4)

org.apache.cassandra:cassandra-all MAVEN version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - me.prettyprint:hector-core =0.7.0-29, =1.0-07, =1.0-09 -...

org.infinispan:infinispan-cachestore-cassandra (>=5.1.0.beta2, <=5.1.0.beta4) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (1.0.0-rc2)

org.apache.cassandra:cassandra-all MAVEN version 1.0.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - org.infinispan:infinispan-cachestore-cassandra =5.1.0.beta2, =5.1.0.beta4 Source cves:...

com.ericsson.bss.cassandra.ecaudit:ecaudit_c5.0 (>=3.1.0, <=3.1.1) potentially affected by CVE-2025-23015 +1 more via org.apache.cassandra:cassandra-all (>=5.0.0, <=5.0.2)

org.apache.cassandra:cassandra-all MAVEN version =5.0.0, =3.1.0, =3.1.1 Source cves: CVE-2025-23015, CVE-2025-26467 Source advisory: SNYK:JAVA-ORGAPACHECASSANDRA-8688120...

com.bazaarvoice.astyanax:astyanax-cassandra (3.8.0-bv12), com.bazaarvoice.astyanax:astyanax-contrib (3.8.0-bv12) +42 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (>=3.0.0, <=3.0.28)

org.apache.cassandra:cassandra-all MAVEN version =3.0.0, =6.4.9, =6.4.9, =6.4.9, =6.4.9, =6.4.9, =6.4.9, =6.5.12 and more Source cves: CVE-2025-23015 Source advisory: OSV:GHSA-WMCC-9VCH-JMX4...

com.ericsson.bss.cassandra.ecaudit:ecaudit_c4.0 (>=2.9.0, <=3.1.0), com.instaclustr:cassandra-4 (1.0) +32 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (>=4.0-alpha3, <=4.0.13)

org.apache.cassandra:cassandra-all MAVEN version =4.0-alpha3, =2.9.0, =1.0.2, =1.1, =1.0.0, =1.0.0, =1.1.1 - com.instaclustr:ttl-remover-cassandra-4.0.0 1.0 - com.netflix.priam:priam 4.0.0-alpha9 and more Source cves: CVE-2025-23015 Source advisory: GHSA-WMCC-9VCH-JMX4...

CVE-2025-23015

Apache Cassandra is vulnerable to a Privilege Defined With Unsafe Actions vulnerability (CWE-267 ). A user with MODIFY permission on all keyspaces can escalate privileges to superuser by performing unsafe actions on system resources. This affects versions 3.0.30 , 3.11.17 , 4.0.15 , 4.1.7 , and 5...