UBUNTU-CVE-2020-11729: Critical severity ubuntu/awl vulnerability
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/awlto a version that resolves this vulnerability.Fixed in 0.56-1ubuntu1+esm1 - Upgrade
Upgrade
ubuntu/awlto a version that resolves this vulnerability.Fixed in 0.59-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/awlto a version that resolves this vulnerability.Fixed in 0.60-1+deb10u1ubuntu1
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must successfully brute-force a long-term session cookie that was generated insecurely. The vulnerability does not require authentication or user interaction, and it is remotely reachable.
What access could be gained if exploitation succeeds?
A successfully guessed long-term session cookie could allow an attacker to take over the associated session. The reported impact includes compromise of confidentiality, integrity, and availability.
Which deployments are affected?
The issue affects DAViCal Andrew's Web Libraries (AWL) through version 0.60. The provided data does not identify any configuration prerequisite, so deployments using long-term session cookies should be treated as exposed.