CVE-2020-26214
Summary
| CVE | CVE-2020-26214 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-11-06 18:15:00 UTC |
|---|
| Updated | 2020-11-17 21:08:00 UTC |
|---|
| Description | In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| alerta-server · PyPI |
MISC |
pypi.org |
Third Party Advisory |
| RFC 4513 - Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms |
MISC |
tools.ietf.org |
Third Party Advisory |
| Merge pull request #1345 from alerta/fix-ldap-empty-bind · alerta/alerta@2bfa317 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Disallow LDAP anonymous bind · Issue #1277 · alerta/alerta · GitHub |
MISC |
github.com |
Third Party Advisory |
| LDAP authentication bypass with empty password · Advisory · alerta/alerta · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| Do not allow LDAP login with empty password by satterly · Pull Request #1345 · alerta/alerta · GitHub |
MISC |
github.com |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 983216 Python (pip) Security Update for alerta-server (GHSA-5hmm-x8q8-w5jh)
