Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/cassandra

              trunk @ a44720c
            

214

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Denial of Service: 109 prior fixes. Scrutinize any change in this area.

src/java/org/apache/cassandra/security/SSLFactory.java: most-fixed (8 issues). Treat as high-risk during review.

50 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Unsafe Java deserialization allowed unauthenticated remote code execution on the open stress daemon port. The feature was completely deprecated and removed to permanently close the vector.

Sandbox Escape: UDFs could exploit thread-state management or standard libraries to bypass the custom security manager. Fixes reduced class allowlists, wrapped filters, and restricted JSR 223 scripting engines.

Auth Bypass: A synchronization or node-reconciliation race allowed admin password updates to be overwritten by the default superuser setup. Forcing a write timestamp of 0 prevents regression during cluster repair.