CVE-2020-13946
Description
In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.
How to fix
- apache cassandra2.1.22, 2.2.18, 3.0.22, 3.11.8 or later
- org.apache.cassandra:cassandra-all2.1.12, 2.2.18, 3.0.22, 3.11.8, 4.0-beta2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cassandra | v < 2.1.22, 2.2.0 ≤ v < 2.2.18, 3.0.0 ≤ v < 3.0.22, 3.11.0 ≤ v < 3.11.8, 4.0.0 | 2.1.22, 2.2.18, 3.0.22, 3.11.8 |
| netapp oncommand_insight | No range specified | — |
| org.apache.cassandra:cassandra-allMaven | 2.1.0 ≤ v < 2.1.12, 2.2.0 ≤ v < 2.2.18, 3.0.0 ≤ v < 3.0.22, 3.11.0 ≤ v < 3.11.8, 4.0-beta1 ≤ v < 4.0-beta2 | 2.1.12, 2.2.18, 3.0.22, 3.11.8, 4.0-beta2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.