Security Advisory

CVE-2020-17516

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2021-02-03 16:40:04

Last updated 2024-08-04 14:00:48

Assigner apache

CVSS score not scored

State PUBLISHED

Description

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

← Browse all CVEs View on cve.org ↗