CVE-2020-17516

    Dashboard / Vulnerabilities / CVE-2020-17516

    CVE-2020-17516

    Published: 3 Feb 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

    References: http://mail-archives.apache.org/mod_mbox/cassandra-user/202102.mbox/%3c6E4340A5-D7BE-4D33-9EC5-3B505A626D8D%40apache.org%3e, https://lists.apache.org/thread.html/r81243a412a37a22211754936a13856af07cc68a93d728c52807486e9%40%3Ccommits.cassandra.apache.org%3E, https://lists.apache.org/thread.html/rcb16f36cafa184dd159e94033f87d0fc274c4752d467f3a09f2ceae4%40%3Ccommits.cassandra.apache.org%3E, https://lists.apache.org/thread.html/rd84bec24907617bdb72f7ec907cd7437a0fd5a8886eb55aa84dd1eb8%40%3Ccommits.cassandra.apache.org%3E, https://security.netapp.com/advisory/ntap-20210521-0002/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e06c1e8381525363e90ccf694275361e2958647a
    Fixed -None

    Affected versions

    cassandra-2.2.19
    cassandra-2.2.18
    cassandra-2.2.17
    cassandra-2.2.16
    cassandra-2.2.15
    cassandra-2.2.14
    cassandra-2.2.13
    cassandra-2.2.12
    cassandra-2.2.11
    cassandra-2.2.10
    cassandra-2.2.9
    cassandra-2.2.8
    cassandra-2.2.6
    cassandra-2.2.5
    cassandra-2.2.4
    cassandra-2.2.3
    cassandra-2.2.2
    cassandra-2.2.1
    cassandra-2.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-17516 | CVE-DB