PyPI/alerta-server CVE-2020-26214: unknown, EPSS 65.93%
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deploy
Action: Upgrade alerta-server to 7.5.7 or later.
pip install alerta-server==7.5.7pip install alerta-server==8.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.5.7 | - |
| 8.0.0 | 8.1.0 | - |
Fixed versions
| 7.5.7 | 8.1.0 |
Sources
- osv: PYSEC-2020-159
- https://github.com/alerta/alerta/issues/1277
- https://pypi.org/project/alerta-server/8.1.0/
- https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh
- https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65
- https://tools.ietf.org/html/rfc4513#section-5.1.2
- https://github.com/alerta/alerta/pull/1345
CVE-2020-26214 · published · modified · JSON