PT-2020-13302 · Australian Government · Covidsafe

Published 2020-05-18 · Updated 2021-07-21 · CVE-2020-12857

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions COVIDSafe versions 1.0.15 through 1.0.16

Description The issue allows a remote attacker to long-term re-identify an Android device running COVIDSafe due to the caching of GATT characteristic values (TempID).

Recommendations For COVIDSafe versions 1.0.15 and 1.0.16, consider disabling the caching of GATT characteristic values as a temporary workaround until a patch is available. Restrict access to the TempID to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2020-12857

Affected Products

Covidsafe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-12857 · Security Note
• https://health.gov.au/resources/apps-and-tools/covidsafe-app · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12857 · Vendor Advisory
• https://covidsafe.watch/issue-register/cve-2020-12857-tempid-identifier-was-static · Note
• https://t.me/cvenotify/3873 · Telegram Post
• https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing · Note