CVE-2024-27306 vulnerabilities

Vulnerabilities for packages: kserve, checkov, dask-gateway, py3-cassandra-medusa...

GHSA-7GPW-8WMC-PM8G vulnerabilities

Vulnerabilities for packages: kserve, checkov, dask-gateway, py3-cassandra-medusa...

GHSA-7GPW-8WMC-PM8G vulnerabilities

Vulnerabilities for packages: dask-gateway, py3.13-scanner-test-libraries-aiohttp, py3-cassandra-medusa, kserve, checkov, nemo, request-1276...

cassandra-rs's non-idiomatic use of iterators leads to use after free

Impact Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. Code that uses the item and then advances the iterator is unaffected. This problem has always existed...

GHSA-X9XC-63HG-VCFQ cassandra-rs's non-idiomatic use of iterators leads to use after free

Impact Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. Code that uses the item and then advances the iterator is unaffected. This problem has always existed...

GHSA-9W38-P64V-XPMV vulnerabilities

Vulnerabilities for packages: celeborn, trino, cassandra-reaper, druid, hadoop-client-modules, tez...

GHSA-XJP4-HW94-MVP5 vulnerabilities

Vulnerabilities for packages: celeborn, trino, cassandra-reaper, druid, hadoop-client-modules, tez...

CVE-2024-29131 vulnerabilities

Vulnerabilities for packages: celeborn, trino, cassandra-reaper, druid, hadoop-client-modules, tez...

CVE-2024-29133 vulnerabilities

Vulnerabilities for packages: celeborn, trino, cassandra-reaper, druid, hadoop-client-modules, tez...

BIT-VAULT-2021-27400

HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...

BIT-CASSANDRA-2020-13946

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and...

BIT-CASSANDRA-2020-17516

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internodeencryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despit...

BIT-CASSANDRA-2021-44521 Remote code execution for scripted UDFs

When running Apache Cassandra with the following configuration: enableuserdefinedfunctions: true enablescripteduserdefinedfunctions: true enableuserdefinedfunctionsthreads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissio...

BIT-CASSANDRA-2023-30601 Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, nats, newrelic-prometheus-configurator, wait-for-port, vite, timoni, pulumi-language-yaml, paranoia, ytt, go-bindata, lazygit, cass-operator, flux, nri-discovery-kubernetes, grafana-operator, nri-mysql, aws-load-balancer-controller, nerdctl, temporal,...

CVE-2024-27284

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

Code injection

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

cassandra-rs Resource Management Error Vulnerability

cassandra-rs is an Apache Cassandra client library written in the Rust language. A security vulnerability exists in cassandra-rs versions prior to 3.0.0, which stems from a post-release reuse vulnerability...

CVE-2024-27284 cassandra-rs non-idiomatic use of iterators leads to use after free

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

CVE-2024-27284

The CVE concerns the cassandra-rs Rust Cassandra (CQL) driver. A use-after-free exists when code uses an item from an iterator after advancing the iterator, potentially accessing freed memory. The issue is fixed in version 3.0.0; users with pre-3.0.0 versions should upgrade to 3.0.0 to mitigate. ...