[
https://issues.apache.org/jira/browse/CASSANDRA-9384?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16773211#comment-16773211
]
Dinesh Joshi commented on CASSANDRA-9384:
-----------------------------------------
Rethinking this for existing releases, I wouldn't want C* to start up with the
vulnerable setting. Normally, people don't pay attention to "WARN" messages and
C* generates so many log entries at start up that it is hard for an operator to
decide which ones they should be really concerned about.
For versions other than trunk, here's what I prefer -
# Abort start up if {{auth_bcrypt_gensalt_log2_rounds = 31}}
# Allow operator to start C* with {{auth_bcrypt_gensalt_log2_rounds = 31}} if
they pass in {{-Dcassandra.allow_unsafe_bcrypt}}
# Don't upgrade the jbcrypt binary
That way the operator has a way to use the old behavior but at least it grabs
their attention. We're technically backward compatible and not breaking anybody
except that now they have to consciously choose the bad setting. This should
not affect most users. Thoughts?
> Update jBCrypt dependency to version 0.4
> ----------------------------------------
>
> Key: CASSANDRA-9384
> URL: https://issues.apache.org/jira/browse/CASSANDRA-9384
> Project: Cassandra
> Issue Type: Bug
> Reporter: Sam Tunnicliffe
> Assignee: Dinesh Joshi
> Priority: Major
> Fix For: 2.1.x, 2.2.x, 3.0.x, 3.11.x
>
>
> https://bugzilla.mindrot.org/show_bug.cgi?id=2097
> Although the bug tracker lists it as NEW/OPEN, the release notes for 0.4
> indicate that this is now fixed, so we should update.
> Thanks to [~Bereng] for identifying the issue.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
