Medium CVE-2020-24653 EUVD-2022-5247GHSA-rwx9-wqj8-vr77

Expo on iOS is insecure due incorrect security attribute application

Published Aug 26, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Description

secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	expo	< 9.1.0	9.1.0	GHSA-rwx9-wqj8-vr77

References

https://github.com/expo/expo/pull/9264