CVE-2023-45866

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-45866
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-45866.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-45866
Aliases
Related
Published
2023-12-08T06:15:45Z
Modified
2024-09-18T03:25:37.680519Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

References

Affected packages

Debian:11 / bluez

Package

Name
bluez
Purl
pkg:deb/debian/bluez?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.55-3.1+deb11u1

Affected versions

5.*

5.55-3.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / bluez

Package

Name
bluez
Purl
pkg:deb/debian/bluez?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.66-1+deb12u1

Affected versions

5.*

5.66-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / bluez

Package

Name
bluez
Purl
pkg:deb/debian/bluez?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.70-1.1

Affected versions

5.*

5.66-1
5.68-1
5.68-2
5.69-1
5.70-1
5.70-1.1~exp0

Ecosystem specific

{
    "urgency": "not yet assigned"
}