GHSA-V2XM-76PQ-PHCF vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

CVE-2021-47621 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1...

CVE-2021-47621 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

BIT-SCYLLADB-2023-33972 Privilege escalation from having CREATE access on a keyspace in Scylladb

Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue...

CVE-2024-27306 vulnerabilities

Vulnerabilities for packages: kserve, request-1276, py3.13-scanner-test-libraries-aiohttp, nemo, dask-gateway, checkov, py3-cassandra-medusa...

CVE-2024-27306 vulnerabilities

Vulnerabilities for packages: checkov, kserve, dask-gateway, py3-cassandra-medusa...

GHSA-7GPW-8WMC-PM8G vulnerabilities

Vulnerabilities for packages: checkov, kserve, dask-gateway, py3-cassandra-medusa...

GHSA-7GPW-8WMC-PM8G vulnerabilities

Vulnerabilities for packages: kserve, request-1276, py3.13-scanner-test-libraries-aiohttp, nemo, dask-gateway, checkov, py3-cassandra-medusa...

cassandra-rs's non-idiomatic use of iterators leads to use after free

Impact Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. Code that uses the item and then advances the iterator is unaffected. This problem has always existed...

GHSA-X9XC-63HG-VCFQ cassandra-rs's non-idiomatic use of iterators leads to use after free

Impact Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. Code that uses the item and then advances the iterator is unaffected. This problem has always existed...

GHSA-9W38-P64V-XPMV vulnerabilities

Vulnerabilities for packages: trino, tez, cassandra-reaper, hadoop-client-modules, druid, celeborn...

GHSA-XJP4-HW94-MVP5 vulnerabilities

Vulnerabilities for packages: trino, tez, cassandra-reaper, hadoop-client-modules, druid, celeborn...

CVE-2024-29131 vulnerabilities

Vulnerabilities for packages: trino, tez, cassandra-reaper, hadoop-client-modules, druid, celeborn...

CVE-2024-29133 vulnerabilities

Vulnerabilities for packages: trino, tez, cassandra-reaper, hadoop-client-modules, druid, celeborn...

BIT-VAULT-2021-27400

HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...

BIT-CASSANDRA-2020-13946

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and...

BIT-CASSANDRA-2020-17516

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internodeencryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despit...

BIT-CASSANDRA-2021-44521 Remote code execution for scripted UDFs

When running Apache Cassandra with the following configuration: enableuserdefinedfunctions: true enablescripteduserdefinedfunctions: true enableuserdefinedfunctionsthreads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissio...

BIT-CASSANDRA-2023-30601 Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, newrelic-infra-operator, stakater-reloader, go-licenses, docker-credential-gcr, paranoia, yam, scorecard, kubernetes-dns-node-cache, envoy-ratelimit, cadvisor, metallb, dataplaneapi, bom, kubernetes-event-exporter, ytt, ferretdb, dockerize,...