PT-2020-13301

Name of the Vulnerable Software and Affected Versions OpenTrace versions prior to 1.0.18 COVIDSafe versions prior to 1.0.18 TraceTogether versions prior to 1.0.18 ABTraceTogether versions prior to 1.0.18 Description The issue allows remote attackers to conduct long-term re-identification attacks...

CVE-2020-12717

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

CVE-2020-12717

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

Code injection

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

CVE-2020-11872

The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs...

CVE-2020-11872

The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs...

Session fixation

The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs...

CVE-2020-11872

The CVE-2020-11872 entry concerns the Cloud Functions subsystem in OpenTrace 1.0. The vulnerability arises from fabrications possible by issuing billions of TempID requests before an AES-256-GCM key rotation, as described in the provided documents. The connected records consistently reference the...

CVE-2020-11872

The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs...

PT-2020-12907

Name of the Vulnerable Software and Affected Versions OpenTrace version 1.0 Description The issue in OpenTrace's Cloud Functions subsystem could potentially allow fabrication attacks. This is possible by making a large number of TempID requests before the rotation of an AES-256-GCM key occurs...

CVE-2020-11872: Use of a Broken or Risky Cryptographic Algorithm

The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs...