GHSA-5hmm-x8q8-w5jh

Source

https://github.com/advisories/GHSA-5hmm-x8q8-w5jh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/11/GHSA-5hmm-x8q8-w5jh/GHSA-5hmm-x8q8-w5jh.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-5hmm-x8q8-w5jh

Aliases

Published

2020-11-06T17:35:49Z

Modified

2024-09-04T19:56:07.161754Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

LDAP authentication bypass with empty password

Details

Impact

Users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider.

Only deployments where LDAP servers are configured to allow unauthenticated binds (eg. default on Active Directory) are affected.

Patches

A fix has been implemented that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. See https://github.com/alerta/alerta/pull/1345

Workarounds

LDAP administrators can disallow unauthenticated bind requests by clients.

References

https://tools.ietf.org/html/rfc4513#section-5.1.2 https://pypi.org/project/alerta-server/8.1.0/

For more information

If you have any questions or comments about this advisory: * Add a comment to the issue #1277 * Email us at admin@alerta.dev

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-11-06T17:34:42Z"
}

References

Affected packages

PyPI / alerta-server

Package

Name: alerta-server; View open source insights on deps.dev
Purl: pkg:pypi/alerta-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0.0

Fixed

8.1.0

Affected versions

8.*

8.0.0

8.0.1

8.0.2

8.0.3

PyPI / alerta-server

Package

Name: alerta-server; View open source insights on deps.dev
Purl: pkg:pypi/alerta-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.5.7

Affected versions

3.*

3.1.2

3.2.0

3.2.3

3.2.4

3.2.6

3.2.7

3.2.8

3.2.9

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.7

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.1.0

4.1.1

4.1.2

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.3.0

4.3.1

4.3.2

4.4.0

4.4.1

4.4.2

4.4.5

4.4.6

4.4.7

4.4.8

4.4.9

4.4.10

4.4.11

4.4.12

4.4.13

4.5.0

4.5.1

4.5.2

4.5.3

4.5.4

4.5.5

4.6.0

4.6.1

4.6.2

4.6.3

4.6.4

4.6.5

4.6.6

4.6.7

4.6.8

4.6.9

4.7.0

4.7.1

4.7.2

4.7.3

4.7.4

4.7.5

4.7.6

4.7.7

4.7.8

4.7.9

4.7.10

4.7.11

4.7.12

4.7.13

4.7.14

4.7.15

4.7.16

4.7.17

4.7.18

4.7.19

4.7.20

4.7.21

4.7.22

4.7.23

4.7.24

4.7.25

4.7.26

4.7.27

4.7.28

4.7.29

4.7.30

4.7.31

4.7.32

4.7.33

4.8.0

4.8.1

4.8.2

4.8.3

4.8.4

4.8.5

4.8.6

4.8.7

4.8.8

4.8.9

4.8.10

4.8.11

4.8.12

4.8.13

4.8.14

4.8.15

4.8.16

4.8.17

4.8.18

4.8.19

4.8.20

4.8.21

4.8.22

4.8.23

4.8.24

4.8.25

4.8.26

4.9.0

4.9.1

4.9.2

4.9.3

4.9.4

4.9.5

4.9.6

4.10.0

4.10.1

4.10.2

4.10.3

4.10.4

4.10.5

5.*

5.0.0rc1

5.0.0rc2

5.0.0rc3

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.1.0

5.1.1

5.2.0

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

6.*

6.0.0

6.0.1

6.1.0

6.2.0

6.2.1

6.3.0

6.3.1

6.3.2

6.4.0

6.5.0

6.6.0

6.6.1

6.7.0

6.7.1

6.7.2

6.7.3

6.7.4

6.7.5

6.8.0

6.8.1

6.8.2

6.8.3

6.8.4

6.8.5

7.*

7.0.0

7.0.1

7.1.0

7.1.1

7.1.2

7.2.0

7.2.1

7.2.2

7.2.3

7.2.4

7.2.5

7.2.6

7.2.7

7.2.8

7.2.9

7.2.10

7.2.11

7.3.0

7.3.1

7.3.2

7.4.0

7.4.1

7.4.4

7.4.5

7.4.6

7.5.0

7.5.1

7.5.2

7.5.3

7.5.4

7.5.5

7.5.6