[CASSANDRA-14183] CVE-2017-5929 Security vulnerability and redefine default log rotation policy

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 2.1.21, 2.2.13, 3.0.17, 3.11.3, 4.0-alpha1, 4.0
• Component/s: Dependencies
• Labels: patch security
• Assignee: Thiago Veronezi
• Reporter: Thiago Veronezi

Authors

Thiago Veronezi

Reviewers

Ariel Weisberg

• Created: 22/Jan/18 15:40
• Updated: 16/Mar/22 11:24
• Resolved: 14/Feb/18 21:36

Description

Cassandra 3.11.1 is patched with logback 1.1.3, which contains the security vulnerability described here. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929

Also update to logback allows a simple date and size rotation policy to
replace the default fixed policy, which is broken by design.

Issue Links

• is duplicated by: CASSANDRA-16464 Upgrade to logback package 1.2.0 or later fix high vulnerabilities
• links to: GitHub Pull Request #186