PT-2020-14464 · Duckduckgo · Duckduckgo

Commotionfever · Published 2020-07-02 · Updated 2024-08-04 · CVE-2020-15502

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DuckDuckGo versions 5.58.0 and earlier for Android DuckDuckGo versions 7.47.1.0 and earlier for iOS

Description The application sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain. This might make visit data available temporarily at a potentially unwanted endpoint. The vendor has stated that the favicon service adheres to their strict privacy policy.

Recommendations For DuckDuckGo versions 5.58.0 and earlier for Android, consider disabling the favicon service until a patch is available. For DuckDuckGo versions 7.47.1.0 and earlier for iOS, consider disabling the favicon service until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-15502

Affected Products

Duckduckgo

References · 10

• https://github.com/duckduckgo/Android/blob/e2f2d54a6b4452277467db403a3546512401b493/app/src/main/java/com/duckduckgo/app/global/UriExtension.kt#L83-L88 · Patch
• https://news.ycombinator.com/item?id=23708166 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15502 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15502 · Vendor Advisory
• https://github.com/duckduckgo/Android/issues/527 · Note
• https://github.com/duckduckgo/iOS/blob/1ae03d7221180bd6791cf6f7f06922a96335cf75/Core/AppUrls.swift#L98-L100 · Note
• https://news.ycombinator.com/item?id=23711597 · Note
• https://t.me/cvenotify/84559 · Telegram Post
• https://t.me/cvenotify/88982 · Telegram Post
• https://t.me/cvenotify/4797 · Telegram Post