CVE-2020-17516
Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption sett...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
cassandra
[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"2.1.23"},{"introduced":"2.2.0"},{"fixed":"2.2.20"},{"introduced":"3.0.0"},{"fixed":"3.0.24"},{"introduced":"3.11.0"},{"fixed":"3.11.10"}]}]
Références
- advisory security.netapp.com
- web mail-archives.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web nvd.nist.gov