PyPI/alerta-server CVE-2020-26214: critical 9.1, EPSS 65.93%
LDAP authentication bypass with empty password
Action: Upgrade alerta-server to 7.5.7 or later.
pip install alerta-server==8.1.0pip install alerta-server==7.5.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 8.1.0 | - |
| 0 | 7.5.7 | - |
Fixed versions
| 8.1.0 | 7.5.7 |
Sources
- osv: GHSA-5hmm-x8q8-w5jh
- https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh
- https://nvd.nist.gov/vuln/detail/CVE-2020-26214
- https://github.com/alerta/alerta/issues/1277
- https://github.com/alerta/alerta/pull/1345
- https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65
- https://github.com/alerta/alerta
- https://github.com/pypa/advisory-database/tree/main/vulns/alerta-server/PYSEC-2020-159.yaml
- https://pypi.org/project/alerta-server/8.1.0
- https://tools.ietf.org/html/rfc4513#section-5.1.2
CVE-2020-26214 · published · modified · JSON