CVE-2020-11728

NameCVE-2020-11728
DescriptionAn issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2178-1, DSA-4660-1
Debian Bugs956650

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
awl (PTS)buster, buster (security)0.60-1+deb10u1fixed
bullseye0.62-1fixed
sid, trixie, bookworm0.64-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
awlsourcejessie0.55-1+deb8u1DLA-2178-1
awlsourcestretch0.57-1+deb9u1DSA-4660-1
awlsourcebuster0.60-1+deb10u1DSA-4660-1
awlsource(unstable)0.61-1956650

Notes

https://gitlab.com/davical-project/awl/-/issues/19
https://gitlab.com/davical-project/awl/-/commit/c2e808cc2420f8d870ac0a4aa9cc1f2c90562428
Search for package or bug name: Reporting problems