CVE-2020-17516CWE-290

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting…

published February 3, 2021

CVSS
—
EPSS
2%
Percentile
79.9
In the wild
Unconfirmed
What it is

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01931 · 79.9th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2021-02-03T16:40Z
EPSS history
Timeline
  • 03 FEB 16:40Z
    Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting…
    cvelistv5