UBUNTU-CVE-2020-11728: High severity ubuntu/awl vulnerability

Q: What must an attacker know to hijack a session?

The attacker must be able to guess the microsecond timestamp used for the session key and the incrementing session_id. With those values, they can impersonate an existing session.

Q: What is the impact of successful exploitation?

A successful attacker can impersonate a session, which may expose information available to that session. The supplied severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

Q: Which AWL versions are affected?

DAViCal Andrew's Web Libraries (AWL) through version 0.60 are affected.

Published Apr 15, 2020

Updated

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing sessionid) can impersonate a session.

Affected Software

3 affected componentsFixes available

ubuntu/awl<0.56-1ubuntu1+esm1

0.56-1ubuntu1+esm1

ubuntu/awl<0.59-1ubuntu0.1~esm1

0.59-1ubuntu0.1~esm1

ubuntu/awl<0.60-1+deb10u1ubuntu1

0.60-1+deb10u1ubuntu1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/awl to a version that resolves this vulnerability.
Fixed in 0.56-1ubuntu1+esm1
Upgrade
Upgrade ubuntu/awl to a version that resolves this vulnerability.
Fixed in 0.59-1ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/awl to a version that resolves this vulnerability.
Fixed in 0.60-1+deb10u1ubuntu1

Event History

Apr 15, 2020

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker know to hijack a session?

The attacker must be able to guess the microsecond timestamp used for the session key and the incrementing session_id. With those values, they can impersonate an existing session.

What is the impact of successful exploitation?