Man-in-the-Middle (MitM) Affecting org.apache.cassandra:cassandra-all package, versions [2.1.0,2.3.0) [3.0.0,3.0.24) [3.11.0,3.11.10)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
3 Feb 2021
2 Feb 2021
How to fix?
org.apache.cassandra:cassandra-all to version 2.3.0, 3.0.24, 3.11.10 or higher.
org.apache.cassandra:cassandra-all is a maven plugin for the Apache Cassandra Project. Which, develops a highly scalable second-generation distributed database, bringing together Dynamo's fully distributed design and Bigtable's ColumnFamily-based data model.
Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). When using
internode_encryption setting, a Cassandra instance allows both encrypted and unencrypted connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.