CVE-2020-0460: VPN Settings Dialog Doesn't Open Certificate File Picker in KeyChain
Summary
CVE-2020-0460: In createNameCredentialDialog of CertInstaller.java, there exists the possibility of improperly installed certificates due to a logic error. Affects platform/packages/apps/KeyChain versions >= 11:0, < 11:2020-12-01. Fixed in 11:2020-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The KeyChain package is a part of the Android ecosystem and is responsible for managing certificates and credentials on the device. It provides a secure storage mechanism for sensitive information such as private keys, certificates, and passwords. The package is crucial for maintaining the security and integrity of various applications and services on the Android platform.
Vulnerability Detail
The vulnerability (CVE-2020-0460) exists in the VPN Settings Dialog of the KeyChain package. Specifically, in the createNameCredentialDialog function of CertInstaller.java, there is a logic error that can result in improperly installed certificates. This vulnerability can be exploited to disclose remote information without requiring additional execution privileges. Notably, user interaction is not necessary for the exploitation of this vulnerability.
How To Fix
Minimum fixed version
11:2020-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that they update the KeyChain package to the latest version as soon as it becomes available.
Conclusion
The vulnerability (CVE-2020-0460) in the KeyChain package's VPN Settings Dialog can lead to the improper installation of certificates and remote information disclosure. It is crucial to update the KeyChain package to version 11 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/KeyChain →
FAQ
The vulnerability allows for remote information disclosure without requiring additional execution privileges. This can potentially lead to the exposure of sensitive data stored in improperly installed certificates.
No, user interaction is not needed for the exploitation of this vulnerability.
Versions prior to 11 are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 11 of the KeyChain package, released on December 1, 2020.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the gradle.lockfile without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/KeyChain.
