Expo on iOS is insecure due incorrect security attribute application

Description

secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

Recommendation

Update the expo package to the latest compatible version. Followings are version details:

• Affected version(s): < 9.1.0
• Patched version(s): 9.1.0

References

• GHSA-rwx9-wqj8-vr77
• CVE-2020-24653
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
• Strapi Allows Unauthorized Access to Private Fields via parms.lookup - CVE-2024-56143

Tags:

npm

expo