[CASSANDRA-16455] CVE-2020-17516 mitigation in 2.2.x branch

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 2.2.20
• Component/s: Local/Other
• Bug Category: Security
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Assignee: Unassigned
• Reporter: Mark Denihan
• Created: 17/Feb/21 15:49
• Updated: 15/Sep/21 07:11
• Resolved: 15/Sep/21 07:11

Description

As a Cassandra 2.2.x user
I would like to know if a fix is planned for CVE-2020-17516 in this branch

https://mail-archives.apache.org/mod_mbox/cassandra-user/202102.mbox/[e-mail]%3e

CVE-2020-17516: Apache Cassandra doesn't enforce encryption setting on inbound internode connections

Severity:
Important

Vendor:
The Apache Software Foundation

Versions Affected:
Cassandra 2.1.0 to 2.1.22
Cassandra 2.2.0 to 2.2.19
Cassandra 3.0.0 to 3.0.23
Cassandra 3.11.0 to 3.11.9
....
....
....

Mitigation:
Users of ALL versions should switch from ‘dc’ or ‘rack’ to ‘all’ internode_encryption
setting, as they are inherently insecure
3.0.x users should additionally upgrade to 3.0.24
3.11.x users should additionally upgrade to 3.11.24

I can't find any ticket tracking implementing this fix in 2.2.x or 2.1.x.