Carrodher

**Name of the Vulnerable Software and Affected Versions** Bitnami Cassandra container images versions 4.0.x prior to 4.0.20-photon-5-r7 Bitnami Cassandra container images versions 4.1.x prior to 4.1.11-photon-5-r7 Bitnami Cassandra container images versions 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3 **Description** Container initialization scripts fail to remove the built-in cassandra account when a custom administrator account is configured using the `CASSANDRA USER` environment variable. This allows a remote attacker who knows the default credentials to authenticate to the cluster as a full superuser, bypassing the intended account replacement. **Recommendations** Update versions 4.0.x to 4.0.20-photon-5-r7 or later. Update versions 4.1.x to 4.1.11-photon-5-r7 or later. Update versions 5.0.x to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3 or later.

**Name of the Vulnerable Software and Affected Versions** Bitnami MariaDB Galera container image versions 10.6.x prior to 10.6.27-photon-5-r0 Bitnami MariaDB Galera container image versions 10.11.x prior to 10.11.17-photon-5-r1 Bitnami MariaDB Galera container image versions 11.4.x prior to 11.4.12-photon-5-r0 Bitnami MariaDB Galera container image versions 11.8.x prior to 11.8.7-photon-5-r1 Bitnami MariaDB Galera container image versions 12.3.x prior to 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0 Bitnami MariaDB Galera Helm chart versions prior to 18.3.0 **Description** Hardcoded default credentials exist for the Galera replication health-check user. The environment variables `MARIADB REPLICATION USER` and `MARIADB REPLICATION PASSWORD` both default to "monitor". This user is granted REPLICATION CLIENT privileges from any host ('%'). Because the Helm chart did not expose parameters to configure these credentials, all deployments used these known defaults. A remote attacker with network access to the MariaDB port can authenticate using these credentials to query replication topology and status information. **Recommendations** Update container image 10.6.x to 10.6.27-photon-5-r0 or later. Update container image 10.11.x to 10.11.17-photon-5-r1 or later. Update container image 11.4.x to 11.4.12-photon-5-r0 or later. Update container image 11.8.x to 11.8.7-photon-5-r1 or later. Update container image 12.3.x to 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0 or later. Update Helm chart to version 18.3.0 or later.