Description
In Apache Cassandra it is possible for a local attacker without access
to the Apache Cassandra process or configuration files to manipulate
the RMI registry to perform a man-in-the-middle attack and capture user
names and passwords used to access the JMX interface. The attacker can
then use these credentials to access the JMX interface and perform
unauthorized operations.
This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10.
This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11.
Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Cassandra | 4.0.2 – < 4.0.15, 4.1.0 – < 4.1.8, 5.0-beta1 – < 5.0.3 | 4.0.15 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cassandra | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | cassandra | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cassandra:cassandra-all | >= 5.0-beta1, < 5.0.3 | 5.0.3 | GHSA-rgfx-7p65-3ff4 |
| Maven | org.apache.cassandra:cassandra-all | >= 4.1.0, < 4.1.8 | 4.1.8 | GHSA-rgfx-7p65-3ff4 |
| Maven | org.apache.cassandra:cassandra-all | >= 4.0.2, < 4.0.15 | 4.0.15 | GHSA-rgfx-7p65-3ff4 |
Advisories 1
- WID-SEC-2025-0258 Apache Cassandra: Mehrere Schwachstellen. BSI CERT-Bund (WID) · Feb 4, 2025
References
- https://lists.apache.org/thread/jsk87d9yv8r204mgqpz1qxtp5wcrpysm vendor-advisory