[
https://issues.apache.org/jira/browse/CASSANDRA-21560?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Stefan Miklosovic updated CASSANDRA-21560:
------------------------------------------
Fix Version/s: 4.0.22
4.1.13
5.0.10
6.0-alpha3
7.0
Since Version: 4.0.0
Source Control Link:
https://github.com/apache/cassandra/commit/3bee95d009c7ad2c069c4e5f3466892990cd688f
Resolution: Fixed
Status: Resolved (was: Ready to Commit)
> Validate authz before performing role check in LIST ROLES/PERMISSIONS
> ---------------------------------------------------------------------
>
> Key: CASSANDRA-21560
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21560
> Project: Apache Cassandra
> Issue Type: Bug
> Components: Legacy/Core
> Reporter: Francisco Guerrero
> Assignee: Francisco Guerrero
> Priority: Normal
> Fix For: 4.0.22, 4.1.13, 5.0.10, 6.0-alpha3, 7.0
>
> Attachments: cassandra-4.0-ci_summary.html,
> cassandra-4.1-ci_summary.html
>
>
> In {{ListPermissionsStatement}} and {{ListRolesStatement}} we perform a role
> check existence before ensuring the logged in user has access to list roles
> or permissions of that user.
> This could allow someone without access to list roles or permissions to check
> for existence of a role in the database, as the error message will show
> {{role foo does not exist}}.
> We should reverse the conditions and perform the validation before performing
> the role check.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
