2 years ago

It’s always something when it comes to security. This time around the https://research.jfrog.com/ has found a remote code execution (RCE) issue in https://cassandra.apache.org/, the popular open source NoSQL database.

The bad news is that with these perfectly reasonable Cassandra options in the cassandra.yaml configuration file: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false

It would be all too easy to pop this security crack open.

The most obnoxious of these is to get a user-defined function (UDF) to run more than it allotted time.