Logo
›
›vulnerability›CVE-2023-45866
Name
CVE-2023-45866
Source
NVD ( link)Debian ( link)
Description
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.
CWEs
CWE-287
Published Date
Updated Date
Workaround
-
Advisories
http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelogRelease Notes
http://seclists.org/fulldisclosure/2023/Dec/7Mailing List
http://seclists.org/fulldisclosure/2023/Dec/9Mailing List
https://bluetooth.comNot Applicable
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675Mailing List
https://github.com/skysafe/reblog/tree/main/cve-2023-45866Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00011.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/Mailing List
https://support.apple.com/kb/HT214035Third Party Advisory
https://support.apple.com/kb/HT214036Third Party Advisory
http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelogRelease Notes
http://seclists.org/fulldisclosure/2023/Dec/7Mailing List
http://seclists.org/fulldisclosure/2023/Dec/9Mailing List
https://bluetooth.comNot Applicable
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675Mailing List
https://github.com/skysafe/reblog/tree/main/cve-2023-45866Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00011.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/Mailing List
https://support.apple.com/kb/HT214035Third Party Advisory
https://support.apple.com/kb/HT214036Third Party Advisory

Analysis#

Affected Component
Analysis
bluez5
Patched

Vulnerability Rating#

6.3
CVSSv31

Others affected components#

Name
Project
Project Version
Version
Status
bluez5
yocto
master
5.86
Not Affected
bluez5
yocto
scarthgap
5.72
Not Affected

Resolved with patches#

bluez5 (yocto:kirkstone)

#
Title
Author
Resolve
1
input.conf: Change default of ClassicBondedOnly
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
CVE-2023-45866