~ / search / GHSA-2vxm-vp4c-fjfw

GHSA-2vxm-vp4c-fjfw

Authentication Bypass in Apache Cassandra

Source: GitHub Advisory Database (reviewed) High CVE-2020-17516

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.cassandra:cassandra-all >= 2.1.0, < 3.0.24 3.0.24
Maven org.apache.cassandra:cassandra-all >= 3.11.0, < 3.11.10 3.11.10

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

References

External links from the advisory. They lead to third-party sites.