• Menu
  • Skip to main content
  • Skip to primary sidebar

The Cyber Security News

Latest Cyber Security News

Header Right

  • Latest News
  • Vulnerabilities
  • Cloud Services
high severity rce security bug reported in apache cassandra database software

High-Severity RCE Security Bug Reported in Apache Cassandra Database Software

You are here: Home / General Cyber Security News / High-Severity RCE Security Bug Reported in Apache Cassandra Database Software
February 16, 2022

Researchers have uncovered details of a now-patched substantial-severity security vulnerability in Apache Cassandra that, if still left unaddressed, could be abused to attain remote code execution on impacted installations.

“This Apache security vulnerability is effortless to exploit and has the likely to wreak havoc on systems, but the good news is only manifests in non-default configurations of Cassandra,” Omer Kaspi, security researcher at DevOps firm JFrog, mentioned in a complex compose-up released Tuesday.

Apache Cassandra is an open up-supply, dispersed, NoSQL databases management process for taking care of extremely substantial amounts of structured knowledge throughout commodity servers.

✔ Approved From Our Partners
AOMEI Backupper Lifetime

Protect and backup your data using AOMEI Backupper. AOMEI Backupper take secure and enxrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized seller: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code


Automatic GitHub Backups

Tracked as CVE-2021-44521 (CVSS score: 8.4), the vulnerability problems a unique situation where the configuration for consumer-defined capabilities (UDFs) are enabled, successfully allowing an attacker to leverage the Nashorn JavaScript engine, escape the sandbox, and obtain execution of untrusted code.

Apache Cassandra Database Software

Specially, it was found that Cassandra deployments are vulnerable to CVE-2021-44521 when the cassandra.yaml configuration file incorporates the adhering to definitions:

  • permit_consumer_outlined_capabilities: accurate
  • permit_scripted_person_outlined_capabilities: accurate
  • empower_person_defined_functions_threads: false

“When the [enable_user_defined_functions_threads] solution is set to fake, all invoked UDF functions run in the Cassandra daemon thread, which has a security supervisor with some permissions,” Kaspi said, thus allowing the adversary to disable the security supervisor and break out of the sandbox and operate arbitrary shell instructions on the server.

Prevent Data Breaches

Apache Cassandra consumers are inspired to enhance to versions 3..26, 3.11.12, and 4..2 to keep away from achievable exploitation, which addresses the flaw by including a new flag “permit_extra_insecure_udfs” that is established to false by default and stops turning off the security manager.

Located this short article exciting? Abide by THN on Facebook, Twitter  and LinkedIn to browse a lot more exclusive material we write-up.


Some pieces of this article are sourced from:
thehackernews.com

Previous Post: «facebook agrees to pay $90 million to settle decade old privacy Facebook Agrees to Pay $90 Million to Settle Decade-Old Privacy Violation Case
Next Post: EU Data Protection Watchdog Calls for Ban on Pegasus-like Commercial Spyware eu data protection watchdog calls for ban on pegasus like commercial»

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Report This Article

Recent Posts

  • Sioux Falls Funds DSU Cybersecurity Lab
  • ‘CryptoRom’ Crypto-Scam is Back via Side-Loaded Apps
  • Irish Watchdog Fines Meta $19m Over Data Breach
  • Avast Merger Raises Competition Concerns
  • Linux botnet spreads using Log4Shell flaw
  • Another Destructive Wiper Targets Organizations in Ukraine
  • New “B1txor20” Linux Botnet Uses DNS Tunnel and Exploits Log4J Flaw
  • New Infinite Loop Bug in OpenSSL Could Let Attackers Crash Remote Servers
  • FBI, CISA Warn of Russian Hackers Exploiting MFA and PrintNightmare Bug
  • Unpatched RCE Bug in dompdf Project Affects HTML to PDF Converters

Copyright © TheCyberSecurity.News, All Rights Reserved.