av9ash/GitBugs huggingface dataset:
Bug: User Defined nodetool cleanup only processes one SSTable per table
Status: Open
Priority: Normal
Created: 29/Jun/21 17:36

User defined nodetool cleanup uses a HashMap instead of a MultiMap to group the user provided SSTables by table.  This means it only keeps one file per source table.

It also means the unit test for this component is not sufficient.

As part of https://issues.apache.org/jira/browse/CASSANDRA-16767  I introduced a helper method on Descriptor:
{code:java}
public static Multimap<ColumnFamilyStore, Descriptor> fromFilenamesGrouped(Collection<String> filenames) {code}
That should be used instead of the custom logic in CompactionManager.forceUserDefinedCleanup.

 

Broken existing code:
{code:java}
        HashMap<ColumnFamilyStore, Descriptor> descriptors = Maps.newHashMap();        for (String filename : filenames)
        {
            // extract keyspace and columnfamily name from filename
            Descriptor desc = Descriptor.fromFilename(filename.trim());
            if (Schema.instance.getCFMetaData(desc) == null)
            {
                logger.warn("Schema does not exist for file {}. Skipping.", filename);
                continue;
            }
            // group by keyspace/columnfamily
            ColumnFamilyStore cfs = Keyspace.open(desc.ksname).getColumnFamilyStore(desc.cfname);
            desc = cfs.getDirectories().find(new File(filename.trim()).getName());
            if (desc != null)
                descriptors.put(cfs, desc);
        } {code}
 

Contents of helper method introduced in other ticket:
{code:java}
 public static Multimap<ColumnFamilyStore, Descriptor> fromFilenamesGrouped(Collection<String> filenames) {
      Multimap<ColumnFamilyStore, Descriptor> descriptors = ArrayListMultimap.create();      for (String filename : filenames)
      {
          // extract keyspace and columnfamily name from filename
          Descriptor desc = Descriptor.fromFilename(filename.trim());
          if (Schema.instance.getCFMetaData(desc) == null)
          {
              logger.warn("Schema does not exist for file {}. Skipping.", filename);
              continue;
          }
          // group by keyspace/columnfamily
          ColumnFamilyStore cfs = Keyspace.open(desc.ksname).getColumnFamilyStore(desc.cfname);
          desc = cfs.getDirectories().find(new File(filename.trim()).getName());
          if (desc != null)
            descriptors.put(cfs, desc);
      }
      return descriptors;
    } {code}
Bug: Remediate Cassandra 3.11.10 JAR dependency vulnerability - org.yaml_snakeyaml
Status: Triage Needed
Priority: Normal
Created: 14/Jun/21 14:09

A JAR dependency is flagged in Cassandra 3.11.10 as having vulnerabilities that have been fixed in newer releases. The following is the Cassandra 3.11.10 source tree for their JAR dependencies: [https://github.com/apache/cassandra/tree/181a4969290f1c756089b2993a638fe403bc1314/lib] . 

JAR *org.yaml_snakeyaml* version *1.11* has the following vulnerability and is fixed in version *1.26*. Recommendation is to upgrade to version *2.29* or greater.

 
||id||cvss||desc||link||packageName||packageVersion||severity||status||vecStr||
|CVE-2017-18640|7.5|The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18640|org.yaml_snakeyaml|1.11|high|fixed in 1.26|CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H|

 

A possible fix strategy is to simply update the JAR to their newest version.
 * See [https://mvnrepository.com/artifact/org.yaml/snakeyaml/1.29]
Bug: Remediate Cassandra 3.11.10 JAR dependency vulnerability - org.apache.thrift_libthrift
Status: Triage Needed
Priority: Normal
Created: 14/Jun/21 14:21

A JAR dependency is flagged in Cassandra 3.11.10 as having vulnerabilities that have been fixed in newer releases. The following is the Cassandra 3.11.10 source tree for their JAR dependencies: [https://github.com/apache/cassandra/tree/181a4969290f1c756089b2993a638fe403bc1314/lib] . 

JAR *org.apache.thrift_libthrift* version *0.9.2* has the following vulnerability and is fixed in version *0.9.3-1*. Recommendation is to upgrade to version *0.9.3-1* or greater.

 
||id||cvss||desc||link||packageName||packageVersion||severity||status||vecStr||
|CVE-2016-5397|8.8|The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5397|org.apache.thrift_libthrift|0.9.2|high|.|CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H|
|CVE-2018-1320|7.5|Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1320|org.apache.thrift_libthrift|0.9.2|high|.|CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N|
|CVE-2019-0205|7.5|In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-0205|org.apache.thrift_libthrift|0.9.2|high|.|CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H|

 

A possible fix strategy is to simply update the JAR to their newest version.
 * See [https://mvnrepository.com/artifact/org.apache.thrift/libthrift/0.9.3-1]
Bug: Remediate Cassandra 3.11.10 JAR dependency vulnerability - ch.qos.logback_logback-core
Status: Triage Needed
Priority: Normal
Created: 14/Jun/21 14:27

A JAR dependency is flagged in Cassandra 3.11.10 as having vulnerabilities that have been fixed in newer releases. The following is the Cassandra 3.11.10 source tree for their JAR dependencies: [https://github.com/apache/cassandra/tree/181a4969290f1c756089b2993a638fe403bc1314/lib] . 

JAR *ch.qos.logback_logback-core* version *1.1.3* has the following vulnerability and is fixed in version *1.2.0*. Recommendation is to upgrade to version *1.2.3* or greater.

 
||id||cvss||desc||link||packageName||packageVersion||severity||status||vecStr||
|CVE-2017-5929|9.8|QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5929|ch.qos.logback_logback-core|1.1.3|critical|fixed in 1.2.0|CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H|

A possible fix strategy is to simply update the JAR to their newest version.
 * See [https://mvnrepository.com/artifact/ch.qos.logback/logback-core/1.2.3]
Bug: "multiple versions of ant detected in path for junit" printed for every junit test case spawned by "ant test"
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 07/Apr/21 18:53
Resolved: 08/Apr/21 21:44

I saw this warning for the first time after CASSANDRA-16391. To be confirmed that it wasn't there with some of the previous patches.

The same warning was taken care of  in CASSANDRA-13232

Seems to me that the issue is similar but the fix will be different.
Bug: Update IDE and Eclipse classpaths for tests (after migration to resolver-ant-tasks)
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 05/Apr/21 09:27
Resolved: 08/Apr/21 09:15

CASSANDRA-16391 broke being able to compile the project in IDE (and Eclipse?) as the test dependency jar files are no longer placed under {{build/lib/jar/}}. They are now found under {{build/test/lib/jar/}}.
Bug: Enable offline builds with resolver-ant-tasks
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 03/Apr/21 10:03
Resolved: 06/Apr/21 17:11

Follow-on to CASSANDRA-16391

When all dependencies are already in the local {{~/.m2/repository/}} we should not be needing an internet connection. ("Offline" mode should be automatic.)

This patch also does away with the copying of jar files from {{~/.m2/repository/}} into {{build/lib/jars/}} and {{build/test/lib/jars/}}.

Instead, all the build classpaths are built using each dependencies from their ~/.m2/repository/ locations. The {{lib/}} folder is still generated for building the binary artifact.

Patch at https://github.com/apache/cassandra/compare/trunk...thelastpickle:mck/16559/trunk
Bug: NPE getting host_id in Gossiper.isSafeForStartup
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 10/Apr/21 16:17
Resolved: 21/Apr/21 22:31

As seen here: https://ci-cassandra.apache.org/job/Cassandra-devbranch/604/testReport/junit/org.apache.cassandra.distributed.upgrade/MixedModeGossipTest/testStatusFieldShouldExistInOldVersionNodesEdgeCase/

{noformat}
java.lang.NullPointerException
	at org.apache.cassandra.gms.Gossiper.isSafeForStartup(Gossiper.java:952)
	at org.apache.cassandra.service.StorageService.checkForEndpointCollision(StorageService.java:657)
	at org.apache.cassandra.service.StorageService.prepareToJoin(StorageService.java:933)
	at org.apache.cassandra.service.StorageService.initServer(StorageService.java:784)
	at org.apache.cassandra.service.StorageService.initServer(StorageService.java:729)
	at org.apache.cassandra.distributed.impl.Instance.lambda$startup$10(Instance.java:541)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.lang.Thread.run(Thread.java:748)
{noformat}

I believe what is happening is a GossipDigestAck has been queued to ack the shutdown state from the node on the seed, but isn't actually sent until the node has restarted and gone into shadow.  Since the ack contains the node's IP, it assumes a host_id will be there but since this is not an actual shadow response, it is not.
Bug: Spring boot application and AWS Cassandra DB connectivity issue
Status: Resolved
Priority: Normal
Resolution: Won't Fix
Created: 22/Jun/21 13:00
Resolved: 22/Jun/21 13:30

Hi All,

Facing an issue while starting spring boot application, and throwing exception while connecting to AWS cassandra DB.

We are using spring-boot-starter-data-cassandra and java-driver-core to create CqlSession. 

PFA logs at time of service startup.

Appreciate a quick response on the side. 

Thanks
Jaimin
Bug: Only include versioned files in rat-report
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 26/Apr/21 18:46
Resolved: 27/Apr/21 08:38

Recent changes to the ant build.xml file to include running the Apache Rat reporting tool break the build when there are unversioned files in the source tree.
We could modify the build to only include versioned files in the Rat report.
Bug: Clarify docs for sstableloader around Cassandra node stopping
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 16/Jun/21 08:56
Resolved: 16/Jun/21 09:47

The documentation related to SSTableLoader is little bit confusing around when a node should be stopped and what node that should be.

See the PR https://github.com/apache/cassandra/pull/1072 where this improvement is addressed.
Bug: Consolidate test options in build.xml
Status: Open
Priority: Normal
Created: 15/Jun/21 15:43

There are quite a few different targets where we add things such as :

{noformat}
      <jvmarg value="-Dcassandra.ring_delay_ms=1000"/>
      <jvmarg value="-Dcassandra.tolerate_sstable_size=true"/>
      <jvmarg value="-Dcassandra.skip_sync=true" />
{noformat}

It would be good to not repeat these so much and have a more unified place to adjust them.
Bug: Remediate Cassandra 3.11.10 JAR dependency vulnerability - commons-codec_commons-codec
Status: Triage Needed
Priority: Normal
Created: 14/Jun/21 14:56

A JAR dependency is flagged in Cassandra 3.11.10 as having vulnerabilities that have been fixed in newer releases. The following is the Cassandra 3.11.10 source tree for their JAR dependencies: [https://github.com/apache/cassandra/tree/181a4969290f1c756089b2993a638fe403bc1314/lib] . 

JAR *commons-codec_commons-codec* version *1.9* has the following vulnerability and is fixed in version *1.13*. Recommendation is to upgrade to version *1.15* or greater.

 
||id||cvss||desc||link||packageName||packageVersion||severity||status||vecStr||
|PRISMA-2021-0055|0|Versions <1.13 of this package are vulnerable to Information Exposure. When there is no byte array value that can be encoded into a string, the Base32 implementation does not reject it, and instead decodes it into an arbitrary value which can be re-encoded again using the same implementation. This allows for information exposure exploits such as tunneling additional information via seemingly valid base 32 strings. |.|commons-codec_commons-codec|1.9|low|fixed in 1.13|.|

 

A possible fix strategy is to simply update the JAR to their newest version.
 * See [https://mvnrepository.com/artifact/commons-codec/commons-codec/1.15]
Bug: Remediate Cassandra 3.11.10 JAR dependency vulnerability - com.thinkaurelius.thrift_thrift-server
Status: Triage Needed
Priority: Normal
Created: 14/Jun/21 15:00

A JAR dependency is flagged in Cassandra 3.11.10 as having vulnerabilities that have been fixed in newer releases. The following is the Cassandra 3.11.10 source tree for their JAR dependencies: [https://github.com/apache/cassandra/tree/181a4969290f1c756089b2993a638fe403bc1314/lib] . 

JAR *com.thinkaurelius.thrift_thrift-server* version *0.3.7* has the following vulnerability. Recommendation is to upgrade to version *0.3.9*.

 
||id||cvss||desc||link||packageName||packageVersion||severity||status||vecStr||
|CVE-2016-5397|8.8|The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5397|com.thinkaurelius.thrift_thrift-server|0.3.7|high| |CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H|
|CVE-2019-0205|7.5|In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-0205|com.thinkaurelius.thrift_thrift-server|0.3.7|high| |CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H|

A possible fix strategy is to simply update the JAR to their newest version.
 * See [https://mvnrepository.com/artifact/com.thinkaurelius.thrift/thrift-server/0.3.9]
Bug: Queries returning static content when the partition has no rows might fail to return some rows
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 21/May/21 10:00
Resolved: 10/Jun/21 09:18

The problem can be reproduced with the following test:
{code}
    @Test
    public void testStaticColumnDeletionWithMultipleStaticColumns() throws Throwable
    {
        createTable("CREATE TABLE %s (pk int, ck int, s1 int static, s2 int static, v int, PRIMARY KEY(pk, ck))");
        execute("INSERT INTO %s (pk, s1, s2) VALUES (1, 1, 1) USING TIMESTAMP 1000");
        flush();
        execute("INSERT INTO %s (pk, s1) VALUES (1, 2) USING TIMESTAMP 2000");
        flush();
        execute("DELETE s1 FROM %s USING TIMESTAMP 3000 WHERE pk = 1");
        flush();
        assertRows(execute("SELECT * FROM %s WHERE pk=1"), row(1, null, null, 1, null));
        assertRows(execute("SELECT s1, s2 FROM %s WHERE pk=1"), row((Integer) null, 1));
        assertRows(execute("SELECT s1 FROM %s WHERE pk=1"), row((Integer) null)); // <-FAIL
    }
{code}

This problem is a regression in 4.0 and trunk
Bug: Cassandra can return no row when the row columns have been deleted.
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 17/May/21 15:22
Resolved: 11/Jun/21 09:33

It is the semantic of CQL that a (CQL) row exists as long as it has one non-null column (including the PK columns).

To determine if a row has some *non-null primary key*, Cassandra relies on the row primary key liveness. 

For example:

{code}
CREATE TABLE test (pk int, ck int, v int, PRIMARY KEY(pk, ck));
INSERT INTO test(pk, ck, v) VALUES (1, 1, 1);
DELETE v FROM test WHERE pk = 1 AND ck = 1
SELECT v FROM test;
{code}
will return
{code}
v
---
null 
{code}

{{UPDATE}} statements do not set the row primary key liveness by consequence if the user had used an {{UPDATE}} statement instead of an {{INSERT}} the {{SELECT}} query would *not have returned any rows*.

CASSANDRA-16226 introduced a regression by stopping early in the timestamp ordered logic if an {{UPDATE}} statement covering all the columns was found in an SSTable. As the row returned did not have a primary key liveness if another node was also returning a column deletion, the expected row will not be returned.

The problem can be reproduced with the following test:
{code}
   @Test
    public void testSelectWithUpdatedColumnOnOneNodeAndColumnDeletionOnTheOther() throws Throwable
    {
        try (Cluster cluster = init(builder().withNodes(2).start()))
        {
            cluster.schemaChange(withKeyspace("CREATE TABLE %s.tbl (pk int, ck text, v int, PRIMARY KEY (pk, ck))"));
            cluster.get(1).executeInternal(withKeyspace("INSERT INTO %s.tbl (pk, ck, v) VALUES (1, '1', 1) USING TIMESTAMP 1000"));
            cluster.get(1).flush(KEYSPACE);
            cluster.get(1).executeInternal(withKeyspace("UPDATE %s.tbl USING TIMESTAMP 2000 SET v = 2 WHERE pk = 1 AND ck = '1'"));
            cluster.get(1).flush(KEYSPACE);

            cluster.get(2).executeInternal(withKeyspace("DELETE v FROM %s.tbl USING TIMESTAMP 3000 WHERE pk=1 AND ck='1'"));
            cluster.get(2).flush(KEYSPACE);

            assertRows(cluster.coordinator(2).execute(withKeyspace("SELECT * FROM %s.tbl WHERE pk=1 AND ck='1'"), ConsistencyLevel.ALL),
                       row(1, "1", null)); // <-- FAIL
            assertRows(cluster.coordinator(2).execute(withKeyspace("SELECT v FROM %s.tbl WHERE pk=1 AND ck='1'"), ConsistencyLevel.ALL),
                       row((Integer) null));

        }
    }
{code}

 cc: [~maedhroz], [~ifesdjeen]
Bug: Fix flaky test testMetricsWithRepairAndStreamingFromTwoNodes - org.apache.cassandra.distributed.test.metrics.StreamingMetricsTest
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 13/Apr/21 19:12
Resolved: 11/Jun/21 08:08

https://app.circleci.com/pipelines/github/dcapwell/cassandra/882/workflows/8e34d09d-5908-495f-baac-5402e0c8e6ee/jobs/5276

{code}
junit.framework.AssertionFailedError: expected:<[0]> but was:<[2]>
	at org.apache.cassandra.distributed.test.metrics.StreamingMetricsTest.testMetricsWithStreamingFromTwoNodes(StreamingMetricsTest.java:88)
	at org.apache.cassandra.distributed.test.metrics.StreamingMetricsTest.testMetricsWithRepairAndStreamingFromTwoNodes(StreamingMetricsTest.java:48)
{code}
Bug: Fix flaky test user_types_test.py::TestUserTypes::test_type_keyspace_permission_isolation
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 10/Jun/21 23:34
Resolved: 10/Jun/21 23:55

user_types_test.py::TestUserTypes::test_type_keyspace_permission_isolation adds a 5 second sleep to give time for roles to load, this causes tests to fail from time to time.  Rather than hoping the roles are loaded, we can retry if the expected error is seen.
Bug: Describe audit log categories in documentation
Status: Resolved
Priority: Normal
Resolution: Not A Problem
Created: 11/Jun/21 00:16
Resolved: 14/Jun/21 01:03

With CASSANDRA-12151 we have a nice audit log functionality for the database and it's [described in the docs|https://cassandra.apache.org/doc/latest/operating/audit_logging.html] with the associated options.  One thing that's missing is a description of the categories that can be enabled and disabled.  The categories are found in the code [here|https://github.com/apache/cassandra/blob/trunk/src/java/org/apache/cassandra/audit/AuditLogEntryCategory.java#L26]:

{{QUERY, DML, DDL, DCL, OTHER, AUTH, ERROR, PREPARE}}

So it would just be good to have those and a brief description in the docs.
Bug: "desc" on cqlsh 6.0.0 not working with a Cassandra 3.x server
Status: Resolved
Priority: Normal
Resolution: Fixed
Created: 04/May/21 21:50
Resolved: 18/May/21 16:11

The "desc" statement on cqlsh 6.0.0 shipped with Cassandra 4.0 RC1 is not working correctly when it's connected to a Cassandra 3.x server.

Steps to reproduce:
 * Ensure you have docker installed and running
 * Run the following docker commands to create and start a Cassandra 3.11 container
{code:java}
~ $ docker create --name cassandra3 cassandra:3.11.10
5d903e48e0661e39080198de5e8752356a5a666132211a500ea38af0fc2a0356
~ $ docker start cassandra3
cassandra3
~ $ docker exec -ti cassandra3 bash
{code}

 * Inside the docker container, try the default cqlsh version, make sure everything is working correctly
{code:java}
root@5d903e48e066:/# cqlsh
Connected to Test Cluster at 127.0.0.1:9042.
[cqlsh 5.0.1 | Cassandra 3.11.10 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
cqlsh> desc keyspaces;

system_traces  system_schema  system_auth  system  system_distributed

cqlsh> use system_auth;
cqlsh:system_auth> desc tables;

resource_role_permissons_index  role_permissions  role_members  roles

cqlsh:system_auth> select * from roles;

 role      | can_login | is_superuser | member_of | salted_hash
-----------+-----------+--------------+-----------+--------------------------------------------------------------
 cassandra |      True |         True |      null | $2a$10$8UNyioBF41/OZfcCa2aqXOHvXiNXArBHKaUUhMyPAFKpfN8byXonm

(1 rows)
cqlsh:system_auth> exit
{code}

 * Okay, everything worked as expected. Now install {{git}} to clone the Cassandra 4.0 RC1 source code, and {{python3-six}}, which is a dependency of cqlsh
{code:java}
root@5d903e48e066:/# apt-get update -qq && apt-get install -qq git python3-six
...... [truncated]
{code}

* Clone the Cassandra repository and checkout the cassandra-4.0-rc1 tag
{code:java}
root@5d903e48e066:/# git clone -b cassandra-4.0-rc1 --depth 1 https://github.com/apache/cassandra.git cassandra-4.0-rc1
Cloning into 'cassandra-4.0-rc1'...
...... [truncated]
{code}

* Run the cqlsh from the Git repository, and then repeat all the cqlsh statements above
{code:java}
root@5d903e48e066:/# cd cassandra-4.0-rc1/bin
root@5d903e48e066:/cassandra-4.0-rc1/bin# ./cqlsh
Connected to Test Cluster at 127.0.0.1:9042
[cqlsh 6.0.0 | Cassandra 3.11.10 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
cqlsh> desc keyspaces;

cqlsh> use system_auth;
cqlsh:system_auth> desc tables;

cqlsh:system_auth> select * from roles;

 role      | can_login | is_superuser | member_of | salted_hash
-----------+-----------+--------------+-----------+--------------------------------------------------------------
 cassandra |      True |         True |      null | $2a$10$8UNyioBF41/OZfcCa2aqXOHvXiNXArBHKaUUhMyPAFKpfN8byXonm

(1 rows)
cqlsh:system_auth> exit
root@5d903e48e066:/cassandra-4.0-rc1/bin#
{code}

"desc" did not work correctly, but "use" and "select" worked.