747 matches found
com.datastax.spark:kafka-streaming_2.10 (>=1.1.0-beta2 <=1.1.0-rc3), com.datastax.spark:simple-demos_2.10 (>=1.1.0-beta2 <=1.1.0-rc3) +14 more potentially affected by CVE-2020-13946 via org.apache.cassandra:cassandra-all (>=2.1.0 <=2.1.11)
org.apache.cassandra:cassandra-all MAVEN version =2.1.0, =1.1.0-beta2, =1.1.0-beta2, =1.1.0-alpha2, =1.1.0-alpha2, =0.80, =0.1.0, =2.1.10.0, =2.11.0, =0.6.2, =0.3.1, =0.3.1, =0.2.6, =0.2.6, =0.2.7 and more Source cves: CVE-2020-13946 Source advisory: OSV:GHSA-24WW-MC5X-XC43...
io.stargate.db.cassandra:persistence-cassandra-4.0 (>=0.0.2 <=1.0.1) potentially affected by CVE-2020-13946 via org.apache.cassandra:cassandra-all (=4.0-beta1)
org.apache.cassandra:cassandra-all MAVEN version =4.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - io.stargate.db.cassandra:persistence-cassandra-4.0 =0.0.2, =1.0.1 Source cves:...
com.ericsson.bss.cassandra.ecaudit:ecaudit_c3.0 (>=0.21.0 <=2.6.0), com.ericsson.bss.cassandra.ecaudit:ecaudit_c3.0.11 (>=2.0.0 <=2.3.0) +9 more potentially affected by CVE-2020-13946 via org.apache.cassandra:cassandra-all (>=3.0.0 <=3.0.20)
org.apache.cassandra:cassandra-all MAVEN version =3.0.0, =0.21.0, =2.0.0, =0.1.0, =1.0.0, =1.0.0, =3.11.28, =3.11.28, =3.11.28, =3.0.10.0, =1.4.4, =1.4.10 Source cves: CVE-2020-13946 Source advisory: OSV:GHSA-24WW-MC5X-XC43...
GHSA-24WW-MC5X-XC43 Man-in-the-middle attack in Apache Cassandra
In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and...
com.ericsson.bss.cassandra.ecaudit:ecaudit_c2.2 (>=2.2.0 <=2.6.0), com.github.haifengl:unicorn-cassandra_2.11 (>=2.0.0 <=2.1.1) +40 more potentially affected by CVE-2020-13946 via org.apache.cassandra:cassandra-all (>=2.2.0 <=2.2.16)
org.apache.cassandra:cassandra-all MAVEN version =2.2.0, =2.2.0, =2.0.0, =0.6.0, =0.6.0, =2.2.10.0, =1.2.2, =2.2.0, =2.2.0, =1.0.17.Final, =1.1.2.Final - org.hawkular.accounts:hawkular-accounts-sample-websocket-backend =1.0.17.Final - org.hawkular.accounts:hawkular-accounts-sample-websocket-secur...
Man-in-the-middle attack in Apache Cassandra
In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and...
CVE-2021-27400
HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...
Man-in-the-middle (MitM)
github.com/hashicorp/vault is vulnerable to man-in-the-middle attack. The vulnerability exists due to missing hostnames validation when TLS is used to connect to Cassandra clusters...
CVE-2021-27400
HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...
CVE-2021-27400
HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...
Denial of service
HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...
CVE-2021-27400
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) were affected by not validating TLS certificates when connecting to Cassandra clusters. Root cause reported as missing TLS hostname/certificate validation in the Cassandra integration ...
CVE-2021-27400
HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...
PT-2021-17439 · Hashicorp +1 · Hashicorp Vault +2
Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.6.4 HashiCorp Vault and Vault Enterprise versions prior to 1.7.1 Description: The issue concerns the failure to validate TLS certificates when connecting to Cassandra clusters, affectin...
Vault’s Cassandra Integrations Did Not Validate TLS Certificates
Summary Vault and Vault Enterprise “Vault” Cassandra integrations, a Vault storage backend and database secrets engine plugin, did not validate TLS certificates when connecting to Cassandra clusters. This vulnerability, CVE-2021-27400, was fixed in Vault and Vault Enterprise 1.6.4 and 1.7.1...
com.datastax.oss.quarkus:cassandra-quarkus-integration-tests-application (>=1.1.0-rc1 <=1.1.0-rc2), com.datastax.oss.quarkus:cassandra-quarkus-integration-tests-main (>=1.1.0-rc1 <=1.1.0-rc2) +449 more potentially affected by CVE-2021-20289 via org.jboss.resteasy:resteasy-core (=4.6.0.Final)
org.jboss.resteasy:resteasy-core MAVEN version =4.6.0.Final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-core and may be impacted: - com.datastax.oss.quarkus:cassandra-quarkus-integration-tests-application =1.1.0-rc1,...
Security Bulletin: IBM Network Performance Insight 1.3.1 was affected by CVE-2020-17516 in Apache Cassandra.
Summary IBM Network Performance Insight 1.3.1 was affected by CVE-2020-17516 in Apache Cassandra. Vulnerability Details CVEID: CVE-2020-17516 DESCRIPTION: Apache Cassandra could allow a remote attacker to bypass security restrictions, caused by not enforcing encryption setting on inbound internod...
Photon OS 4.0: Cassandra PHSA-2021-4.0-0003
An update of the cassandra package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0003. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Sumanth Pasupuleti Priam 安全漏洞
Sumanth Pasupuleti Priam is an open source application by Sumanth Pasupuleti. A process/tool that runs with Apache Cassandra. Sumanth Pasupuleti Priam has a security vulnerability that can be exploited by an attacker to read anything written by the Priam process...
