CVE-2020-11729

NameCVE-2020-11729
DescriptionAn issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2178-1, DSA-4660-1
Debian Bugs956650

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
awl (PTS)buster, buster (security)0.60-1+deb10u1fixed
bullseye0.62-1fixed
sid, trixie, bookworm0.64-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
awlsourcejessie0.55-1+deb8u1DLA-2178-1
awlsourcestretch0.57-1+deb9u1DSA-4660-1
awlsourcebuster0.60-1+deb10u1DSA-4660-1
awlsource(unstable)0.61-1956650

Notes

https://gitlab.com/davical-project/awl/-/issues/18
https://gitlab.com/davical-project/awl/-/commit/535505c9acd0dda9cf664c38f5f8cb8dd61dc0cd
Search for package or bug name: Reporting problems