USN-9048-1: awl vulnerabilities
Andrew Bartlett discovered that AWL did not properly generate session keys. A remote attacker could possibly use this issue to guess a session key and impersonate another user's session. (CVE-2020-11728)
It was discovered that AWL did not securely generate long-term session cookies. A remote attacker could possibly use this issue to guess a session cookie through a brute-force attack and gain access to another user's session. (CVE-2020-11729)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/awlto a version that resolves this vulnerability.Fixed in 0.56-1ubuntu1+esm1 - Upgrade
Upgrade
ubuntu/awlto a version that resolves this vulnerability.Fixed in 0.59-1ubuntu0.1~esm1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What could an attacker gain by exploiting these issues?
An attacker who can guess a session key could impersonate another user's session. An attacker who brute-forces a long-term session cookie could gain access to another user's session.
Does exploitation require the attacker to be local or authenticated?
The notice describes the attacker as remote. It does not state that prior authentication or local access is required.