Code injection

2020-05-1405:15:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.1%

JSON

The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.

CPENameOperatorVersion
covidsafeeq1.0
covidsafeeq1.1

CPE	Name	Operator	Version
	covidsafe	eq	1.0
	covidsafe	eq	1.1

References

medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708