GCVE - cpe:2.3:a:health:covidsafe:*:*:*:*:*:android:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:health:covidsafe:*:*:*:*:*:android:*:*

part: a version: * update: *

Vendor	Health (`d8354e2c-f30f-5e38-9d9a-76734f115665`)
Product	Covidsafe (`2b3a93c1-0fbe-57d6-bb92-9e829f24793a`)
Edition	*
Language	*
Software edition	*
Target software	android
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-14292`	vulnerable	2026-06-08 05:19:22.840590	Details available In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, which reveals the public Bluetooth address of the victim's phone without authorisation, bypassing the Bluetooth address randomisation protection in the user's phone. Published: 2020-09-09T16:11:54.000Z Updated: 2024-08-04T12:39:36.318Z Open on db.gcve.eu Reference links https://www.health.gov.au/resources/apps-and-tools/covidsafe-app https://covidsafe.watch/issue-register/ https://github.com/AU-COVIDSafe/mobile-android/blob/b827cf3ccef72a3d38c6fc37466a99868823540f/app/src/main/java/au/gov/health/covidsafe/streetpass/Work.kt#L35-L41 https://github.com/alwentiu/CVE-2020-14292	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12860`	vulnerable	2026-06-08 05:17:59.468776	Details available COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name. Published: 2020-05-18T04:20:34.000Z Updated: 2024-08-04T12:04:22.882Z Open on db.gcve.eu Reference links https://www.health.gov.au/resources/apps-and-tools/covidsafe-app https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12859`	vulnerable	2026-06-08 05:17:59.468484	Details available Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify a device model by observing cleartext payload data. This allows re-identification of devices, especially less common phone models or those in low-density situations. Published: 2020-05-18T04:16:00.000Z Updated: 2024-08-04T12:04:22.881Z Open on db.gcve.eu Reference links https://www.health.gov.au/resources/apps-and-tools/covidsafe-app https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12858`	vulnerable	2026-06-08 05:17:59.468188	Details available Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons. Published: 2020-05-18T04:07:46.000Z Updated: 2024-08-04T12:04:22.888Z Open on db.gcve.eu Reference links https://www.health.gov.au/resources/apps-and-tools/covidsafe-app https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12857`	vulnerable	2026-06-08 05:17:59.467861	Details available Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COVIDSafe. Published: 2020-05-18T04:02:31.000Z Updated: 2024-08-04T12:04:22.886Z Open on db.gcve.eu Reference links https://www.health.gov.au/resources/apps-and-tools/covidsafe-app https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing https://covidsafe.watch/issue-register/cve-2020-12857-tempid-identifier-was-static	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12856`	vulnerable	2026-06-08 05:17:59.466016	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.