Apache Cassandra vulnerabilities

The default configuration in Apache Cassandra versions 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, allowing remote attackers to execute arbitrary Java code via an RMI request.

Apache Cassandra 4.0, 4.1, and 5.0 allow an authenticated user to raise query latencies via repeated password changes (authenticated DoS over CQL). The issue is fixed in versions 4.0.20, 4.1.11, and 5.0.7.

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh commands via the ~/.cassandra/cqlsh_history local file. Anyone with access to this file can read the cleartext credentials.