Security Bulletin
Summary
In Datastax Enterprise with IBM, a remote code execution (RCE) security vulnerability in Apache Cassandra exists and has been assigned to CVE-2021-44521.
Vulnerability Details
CVEID: CVE-2021-44521
DESCRIPTION: Apache Cassandra could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw when include configurations for enable_user_defined_functions: true, enable_scripted_user_defined_functions: true, and enable_user_defined_functions_threads: flase. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219451 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| Datastax Enterprise with IBM | 5.1, 6.0, 6.7, 6.8 |
Remediation/Fixes
| Affected Product(s) | Version(s) | Remediation/Fix/Instructions | |||||||||||||||
| Datastax Enterprise with IBM | 5.1, 6.0, 6.7, 6.8 |
DataStax Enterprise (DSE) versions 5.1, 6.0, 6.7, and 6.8 are NOT impacted by CVE-2021-44521 in their default configuration. The cassandra.yaml file should match the table below:
If cassandra.yaml file settings are different from the above table, please either roll back to default settings or update to the following releases:
|
Workarounds and Mitigations
IBM strongly recommends addressing the vulnerability now by either upgrading to the latest versions (5.1.29, 6.0.17, 6.7.16, 6.8.20) or rolling back to default settings.
Get Notified about Future Security Bulletins
References
Acknowledgement
JFrog Security Research Team
Change History
23 Feb 2022: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
More support for:
DataStax Enterprise with IBM
Software version:
5.1, 6.0, 6.7, 6.8
Operating system(s):
Windows, Linux
Document number:
6559060
Modified date:
23 February 2022
UID
ibm16559060