Stay Secure with the Latest Linux Advisories

security advisorysecurity issueupdate

Debian 8: DLA-2178-1: Critical Security Update for Awl Module

Following CVEs were reported against the awl source package: CVE-2020-11728 . Package : awl Version : 0.55-1+deb8u1 CVE ID : CVE-2020-11728 CVE-2020-11729 Debian Bug : 956650 Following CVEs were reported against the awl source package: CVE-2020-11728 An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session. CVE-2020-11729 An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful. For Debian 8 "Jessie", these problems have been fixed in version 0.55-1+deb8u1. We recommend that you upgrade your awl packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Best, Utkarsh . Stay informed about the critical security vulnerabilities in the AWL package for Debian and upgrade to safeguard your systems against potential threats. Debian Awl Security Update, Session Management Issues, Brute-Force Attack Risks. . Severity: Critical. LinuxSecurity.com Team

Apr 18, 2020 •Critical Debian LTS