Skip to content
OpenAdvisories
Unscored USN-9048-1 2 CVEs

awl vulnerabilities

Published Nov 11, 2026 · Updated Nov 12, 2026

Ecosystem: Ubuntu

Summary

Andrew Bartlett discovered that AWL did not properly generate session
keys. A remote attacker could possibly use this issue to guess a session
key and impersonate another user's session. (CVE-2020-11728)

It was discovered that AWL did not securely generate long-term session
cookies. A remote attacker could possibly use this issue to guess a
session cookie through a brute-force attack and gain access to another
user's session. (CVE-2020-11729)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS awl 0.56-1ubuntu1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS awl 0.59-1ubuntu0.1~esm1

Vulnerabilities 2

  • Unscored —
    CVE-2020-11728

    An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a suffici…

    awl awl Debian Ubuntu
  • Unscored —
    CVE-2020-11729

    An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provid…

    awl awl Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-11728
  • report
    https://ubuntu.com/security/CVE-2020-11729