CVE-2020-17516: Authentication Bypass in Apache Cassandra
Summary
CVE-2020-17516: Authentication Bypass in Apache Cassandra. Affects org.apache.cassandra:cassandra-all across 2 version ranges.
>= 2.1.0, < 3.0.24
>= 3.11.0, < 3.11.10
Fixed in 3.0.24 or 3.11.10, depending on the release line you run. How to fix ↓
Also tracked for
- cassandra · Bitnami
The same CVE-2020-17516 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Cassandra is a distributed and highly scalable open-source NoSQL database management system. It provides high availability and fault tolerance with its decentralized architecture. Cassandra is widely used in various applications, including social media platforms, financial services, and IoT systems. However, versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9 are vulnerable to an authentication bypass issue.
Vulnerability Detail
The vulnerability in Apache Cassandra occurs when using the 'dc' or 'rack' internode_encryption setting. It allows both encrypted and unencrypted internode connections. This means that a misconfigured node or a malicious user can establish an unencrypted connection despite not being in the same rack or data center. This bypasses the mutual TLS requirement, potentially leading to unauthorized access and data exposure. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 3.0.243.0.24 -
>= 3.11.0, < 3.11.103.11.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the 'dc' or 'rack' internode_encryption setting and enforce mutual TLS for all internode connections. This can be achieved by modifying the Cassandra configuration file to set the 'internode_encryption' option to 'all'. However, this workaround should only be considered as a temporary measure until the upgrade to the fixed versions can be performed.
Conclusion
In conclusion, Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9 are vulnerable to an authentication bypass issue. It is crucial to upgrade to the fixed versions or apply the temporary workaround to mitigate the risk of unauthorized access and data exposure. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cassandra:cassandra-all →
FAQ
Apache Cassandra is a distributed and highly scalable open-source NoSQL database management system.
Versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9 are affected.
The vulnerability allows unauthorized access and potential data exposure due to an authentication bypass.
Upgrade to the fixed versions of Apache Cassandra: 3.0.24 or later for versions 2.1.x, and 3.11.10 or later for versions 3.11.x.
Yes, a temporary workaround is to disable the 'dc' or 'rack' internode_encryption setting and enforce mutual TLS for all internode connections.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cassandra:cassandra-all.
