PT-2020-16325 · Hazelcast · Ldaploginmodule+2

Published 2020-11-09 · Updated 2020-11-18 · CVE-2020-26168

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hazelcast IMDG Enterprise versions 4.0.0 through 4.0.2 Hazelcast Jet Enterprise versions 4.0.0 through 4.2

Description The LDAP authentication method in LdapLoginModule does not properly verify passwords in certain system-user-dn scenarios, allowing users to be authenticated with invalid passwords.

Recommendations For Hazelcast IMDG Enterprise versions 4.0.0 through 4.0.2, update to version 4.0.3 or later. For Hazelcast Jet Enterprise versions 4.0.0 through 4.2, consider disabling the LdapLoginModule until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-26168

Affected Products

Hazelcast Imdg Enterprise

Hazelcast Jet Enterprise

Ldaploginmodule

References · 7

• https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26168 · Vendor Advisory
• https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass · Vendor Advisory
• https://jet-start.sh/blog/2020/10/23/jet-43-is-released · Vendor Advisory
• https://docs.hazelcast.org/docs/ern/index.html#4-0-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26168 · Security Note
• https://t.me/cibsecurity/16059 · Telegram Post