CVE-2020-12856

OpenTrace (used in COVIDSafe up to v1.0.17) and similar apps on iOS/Android expose a vulnerability where Bluetooth usage enables long-term user re-identification by remote attackers, per CVE-2020-12856. Red‑hat and other sources mirror this description. The Android security bulletin lists CVE-202...

CVE-2020-12856

OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used...

COVIDSafe app input validation error vulnerability

COVIDSafe app is an Australian coronavirus contact tracing app. A security vulnerability exists in versions 1.0 and 1.1 of the COVIDSafe app for IOS-based systems. A remote attacker could exploit the vulnerability by sending specially crafted advertisements via Bluetooth to cause the app to crash...

CVE-2020-12717

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

CVE-2020-12717

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

Code injection

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

CVE-2020-12717

The COVIDSafe Australia app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. T...

CVE-2020-12717

The CVE-2020-12717 entry concerns the COVIDSafe iOS apps (Australia) versions 1.0 and 1.1, with additional impact cited on AB TraceTogether, ProteGO, and TraceTogether. The issue stems from an erroneous subroutine call (OpenTrace manuData.subdata) when processing Bluetooth manufacturer data that ...