CVE-2020-26214
Description
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
How to fix
- alerta_project alerta7.5.7, 8.1.0 or later
- alerta-server8.1.0, 7.5.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alerta_project alerta | v < 7.5.7, 8.0.0 ≤ v < 8.1.0 | 7.5.7, 8.1.0 |
| alerta-serverPyPI | 8.0.0 ≤ v < 8.1.0, v < 7.5.7 | 8.1.0, 7.5.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.