CVE-2020-24653 – secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttr

4 years ago

secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24653

Reference (s):

https://github.com/expo/expo/pull/9264