CVE-2024-27137

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-27137
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27137.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-27137
Aliases
Downstream
Published
2025-02-04T10:19:44.109Z
Modified
2026-06-26T03:54:53.442820893Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Apache Cassandra: unrestricted deserialization of JMX authentication credentials
Details

In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorized operations.

This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10.

This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11.

Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27137.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.0.2"
                },
                {
                    "fixed": "4.0.15"
                },
                {
                    "introduced": "4.1.0"
                },
                {
                    "fixed": "4.1.8"
                },
                {
                    "introduced": "5.0-beta1"
                },
                {
                    "fixed": "5.0.3"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "4.0.2"
                },
                {
                    "fixed": "5.0.2"
                }
            ]
        }
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/cassandra

Affected ranges

Type
GIT
Repo
https://github.com/apache/cassandra
Events
Introduced
25012d2fec1984cc9c1a352f214eb912ca4f10f5
Fixed
b88fe80910deccc4eb648038a92729e31976e291
Introduced
f9e033f519c14596da4dc954875756a69aea4e78
Fixed
044727aabafeab2f6fef74c52d349d55c8732ef5
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b0226c8ea122c3e5ea8680efb0744d33924fd732
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:cassandra:5.0.0:-:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "4.0.2"
        },
        {
            "fixed": "4.0.15"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.8"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.3"
        },
        {
            "last_affected": "5.0.0-NA"
        }
    ]
}

Affected versions

cassandra-1.*
cassandra-1.1.0-beta1
cassandra-1.2.0-beta1
cassandra-1.2.0-beta2
cassandra-2.*
cassandra-2.0.0-beta1
cassandra-2.0.0-beta2
cassandra-2.0.0-rc1
cassandra-2.1.0-beta1
cassandra-3.*
cassandra-3.0.0-alpha1
cassandra-3.4
cassandra-4.*
cassandra-4.0-alpha1
cassandra-4.0-alpha2
cassandra-4.0-alpha3
cassandra-4.0-alpha4
cassandra-4.0-beta1
cassandra-4.0-beta2
cassandra-4.0-beta3
cassandra-4.0-beta4
cassandra-4.0-rc1
cassandra-4.0.10
cassandra-4.0.11
cassandra-4.0.12
cassandra-4.0.13
cassandra-4.0.14
cassandra-4.0.2
cassandra-4.0.3
cassandra-4.0.5
cassandra-4.0.6
cassandra-4.0.7
cassandra-4.0.9
cassandra-4.1.0
cassandra-4.1.1
cassandra-4.1.3
cassandra-4.1.4
cassandra-4.1.5
cassandra-4.1.6
cassandra-4.1.7
cassandra-5.*
cassandra-5.0-alpha2
cassandra-5.0-beta1
cassandra-5.0-rc1
cassandra-5.0.1
cassandra-5.0.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27137.json"