[CASSANDRA-9085] Bind JMX to localhost unless explicitly configured otherwise

• Type: Bug
• Status: Resolved
• Priority: Urgent
• Resolution: Fixed
• Fix Version/s: 2.0.14, 2.1.4
• Component/s: Legacy/Observability, Local/Config
• Labels: security
• Severity: Critical
• Assignee: T Jake Luciani
• Reporter: T Jake Luciani

Authors

T Jake Luciani

• Created: 01/Apr/15 13:51
• Updated: 16/Apr/19 09:31
• Resolved: 01/Apr/15 13:51

Description

Cassandra's default JMX config can lead to someone executing arbitrary code: see http://www.mail-archive.com/[e-mail]/msg41819.html

Issue Links

• relates to: CASSANDRA-9089 Make JMX listen address configurable