CVE-2020-11729

CVE-2020-11729 affects DAViCal Andrew's Web Libraries (AWL) up to version 0.60. Long-term session cookies are not generated securely, enabling a brute-force-style session hijack. Debian/DLA-2178-1 fixes these issues by updating awl to 0.60-1+deb10u1 (and earlier 0.57-1+deb9u1). If deploying AWL, ...

CVE-2020-11728

CVE-2020-11728 affects DAViCal Andrew's Web Libraries (AWL) up to version 0.60. The flaw is weak session management: session keys are not hard-to-guess, enabling impersonation via guessed microsecond time and incrementing session_id. Debian/DSA-4660-1 and USN-4539-1 describe fixed versions (e.g.,...