Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encry

Summary

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Timeline

1. Feb 3, 2021, 4:40 PM UTCCVE published
2. Aug 4, 2024, 2:00 PM UTCRecord last updated

Affected versions

• n/a Apache Cassandra

  2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, 3.11.0 to 3.11.9

• org.apache.cassandra:cassandra-allMaven

  From 2.1.0 · fixed in 3.0.24

• org.apache.cassandra:cassandra-allMaven

  From 3.11.0 · fixed in 3.11.10

References 5