Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using dc or rack internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cassandra | Apache | 2.1.0 (including) | 2.1.22 (including) |
| Cassandra | Apache | 2.2.0 (including) | 2.2.19 (including) |
| Cassandra | Apache | 3.0.0 (including) | 3.0.23 (including) |
| Cassandra | Apache | 3.11.0 (including) | 3.11.9 (including) |