VYPR
← All advisories
High severityNVD Advisory· Published Feb 3, 2021· Updated Aug 4, 2024

CVE-2020-17516

CVE-2020-17516

Description

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Cassandra internode encryption misconfiguration allows unencrypted connections, bypassing mutual TLS.

Vulnerability

Description Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when configured with 'dc' or 'rack' internode_encryption setting, allow both encrypted and unencrypted internode connections. This occurs because the encryption enforcement is incorrectly scoped to rack or datacenter boundaries, failing to reject unencrypted connections from nodes outside those boundaries [1].

Exploitation

A misconfigured node or a malicious user can establish an unencrypted connection to a Cassandra node, even if they are not in the same rack or datacenter. The vulnerability stems from the internode encryption setting not properly restricting unencrypted traffic to only local rack/dc nodes, thus allowing external unencrypted connections [1].

Impact

An attacker who can reach a Cassandra node over the network can bypass mutual TLS authentication by using an unencrypted connection. This compromises the confidentiality and integrity of internode communication, potentially allowing eavesdropping or tampering with data in transit. The severity is high, with a CVSS score of 8.1 [1].

Mitigation

Users should upgrade to patched versions: 2.1.23, 2.2.20, 3.0.24, or 3.11.10. Alternatively, ensure that internode encryption is set to 'all' instead of 'dc' or 'rack' to enforce encryption for all connections [1].

References
  1. NVD - CVE-2020-17516

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.cassandra:cassandra-allMaven
>= 2.1.0, < 3.0.243.0.24
org.apache.cassandra:cassandra-allMaven
>= 3.11.0, < 3.11.103.11.10

Affected products

157

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.