PT-2018-18381 · Apache · Apache Cassandra

Published 2018-06-28 · Updated 2022-05-13 · CVE-2018-8016

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 3.8 through 3.11.1

Description: The default configuration of Apache Cassandra binds an unauthenticated JMX/RMI interface to all network interfaces, allowing remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression that was introduced due to a specific change and is resolved in a later release.

Recommendations: For Apache Cassandra versions 3.8 through 3.11.1, update to version 3.11.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the JMX/RMI interface to minimize the risk of exploitation.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2018-8016

GHSA-52GQ-7J6C-XW6X

Affected Products

Apache Cassandra

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-8016 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8016 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-52gq-7j6c-xw6x · Vendor Advisory
• https://github.com/beobal/cassandra/commit/28ee665b3c0c9238b61a871064f024d54cddcc79 · Note
• https://lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066@%3Cuser.cassandra.apache.org%3E · Note
• https://lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066%40%3Cuser.cassandra.apache.org%3E · Note
• https://issues.apache.org/jira/browse/CASSANDRA-14173 · Note