CVE-2020-12856 Information disclosure in n/a
Remote attackers can re-identify users over time via Bluetooth in contact tracing apps, compromising user privacy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12856?
CVE-2020-12856 is a critical vulnerability in n/a, published on 18 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.
Which versions are affected by CVE-2020-12856?
It affects 3 products.
Products include Alberta Abtracetogether, Health Covidsafe, Tracetogether Tracetogether.
How do I fix CVE-2020-12856?
Upgrade to a fixed version.
Is CVE-2020-12856 being exploited?
There is no known exploitation of CVE-2020-12856 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as A-157038281, ASB-A-157038281, GHSA-9q2w-3c47-gq6j.