UBUNTU-CVE-2021-37577

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2021-37577

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-37577

Upstream

CVE-2021-37577

Published

2024-10-01T15:15:00Z

Modified

2026-05-20T16:05:06.986250042Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3 may permit an unauthenticated man-in-the-middle attacker to identify the Passkey used during pairing by reflection of a crafted public key with the same X coordinate as the offered public key and by reflection of the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. This is a related issue to CVE-2020-26558.

References

Affected packages

Ubuntu:20.04:LTS

bluez

Package

Name: bluez
Purl: pkg:deb/ubuntu/bluez?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.50-0ubuntu4

5.51-0ubuntu1

5.51-0ubuntu2

5.52-0ubuntu1

5.52-0ubuntu2

5.53-0ubuntu1

5.53-0ubuntu2

5.53-0ubuntu3

5.53-0ubuntu3.1

5.53-0ubuntu3.2

5.53-0ubuntu3.3

5.53-0ubuntu3.4

5.53-0ubuntu3.5

5.53-0ubuntu3.6

5.53-0ubuntu3.7

5.53-0ubuntu3.8

5.53-0ubuntu3.9

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bluetooth",
            "binary_version": "5.53-0ubuntu3.9"
        },
        {
            "binary_name": "bluez",
            "binary_version": "5.53-0ubuntu3.9"
        },
        {
            "binary_name": "bluez-cups",
            "binary_version": "5.53-0ubuntu3.9"
        },
        {
            "binary_name": "bluez-hcidump",
            "binary_version": "5.53-0ubuntu3.9"
        },
        {
            "binary_name": "bluez-obexd",
            "binary_version": "5.53-0ubuntu3.9"
        },
        {
            "binary_name": "bluez-tests",
            "binary_version": "5.53-0ubuntu3.9"
        },
        {
            "binary_name": "libbluetooth3",
            "binary_version": "5.53-0ubuntu3.9"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json"

Ubuntu:22.04:LTS

bluez

Package

Name: bluez
Purl: pkg:deb/ubuntu/bluez?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.60-0ubuntu2

5.62-0ubuntu1

5.62-0ubuntu2

5.63-0ubuntu1

5.63-0ubuntu2

5.64-0ubuntu1

5.64-0ubuntu1.1

5.64-0ubuntu1.3

5.64-0ubuntu1.4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bluetooth",
            "binary_version": "5.64-0ubuntu1.4"
        },
        {
            "binary_name": "bluez",
            "binary_version": "5.64-0ubuntu1.4"
        },
        {
            "binary_name": "bluez-cups",
            "binary_version": "5.64-0ubuntu1.4"
        },
        {
            "binary_name": "bluez-hcidump",
            "binary_version": "5.64-0ubuntu1.4"
        },
        {
            "binary_name": "bluez-meshd",
            "binary_version": "5.64-0ubuntu1.4"
        },
        {
            "binary_name": "bluez-obexd",
            "binary_version": "5.64-0ubuntu1.4"
        },
        {
            "binary_name": "bluez-tests",
            "binary_version": "5.64-0ubuntu1.4"
        },
        {
            "binary_name": "libbluetooth3",
            "binary_version": "5.64-0ubuntu1.4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json"

Ubuntu:24.04:LTS

bluez

Package

Name: bluez
Purl: pkg:deb/ubuntu/bluez?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.68-0ubuntu1

5.70-0ubuntu1

5.70-0ubuntu2

5.70-0ubuntu3

5.71-0ubuntu3

5.71-1ubuntu2

5.71-1ubuntu3

5.72-0ubuntu1

5.72-0ubuntu3

5.72-0ubuntu4

5.72-0ubuntu5

5.72-0ubuntu5.1

5.72-0ubuntu5.3

5.72-0ubuntu5.4

5.72-0ubuntu5.5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bluetooth",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez-cups",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez-hcidump",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez-meshd",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez-obexd",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez-source",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez-test-scripts",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "bluez-test-tools",
            "binary_version": "5.72-0ubuntu5.5"
        },
        {
            "binary_name": "libbluetooth3",
            "binary_version": "5.72-0ubuntu5.5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json"

Ubuntu:25.10

bluez

Package

Name: bluez
Purl: pkg:deb/ubuntu/bluez?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.79-2ubuntu1

5.82-1

5.82-1ubuntu1

5.83-1~exp1

5.83-1~exp1ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bluetooth",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez-cups",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez-hcidump",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez-meshd",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez-obexd",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez-source",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez-test-scripts",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "bluez-test-tools",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        },
        {
            "binary_name": "libbluetooth3",
            "binary_version": "5.83-1~exp1ubuntu0.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json"

Ubuntu:26.04:LTS

bluez

Package

Name: bluez
Purl: pkg:deb/ubuntu/bluez?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.83-1~exp1

5.84-1

5.85-1

5.85-2

5.85-3

5.85-4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bluetooth",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez-cups",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez-hcidump",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez-meshd",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez-obexd",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez-source",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez-test-scripts",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "bluez-test-tools",
            "binary_version": "5.85-4"
        },
        {
            "binary_name": "libbluetooth3",
            "binary_version": "5.85-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json"

Ubuntu:Pro:16.04:LTS

bluez

Package

Name: bluez
Purl: pkg:deb/ubuntu/bluez?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.35-0ubuntu2

5.36-0ubuntu1

5.37-0ubuntu5

5.37-0ubuntu5.1

5.37-0ubuntu5.3

5.37-0ubuntu5.3+esm1

5.37-0ubuntu5.3+esm2

5.37-0ubuntu5.3+esm3

5.37-0ubuntu5.3+esm4

5.37-0ubuntu5.3+esm5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bluetooth",
            "binary_version": "5.37-0ubuntu5.3+esm5"
        },
        {
            "binary_name": "bluez",
            "binary_version": "5.37-0ubuntu5.3+esm5"
        },
        {
            "binary_name": "bluez-cups",
            "binary_version": "5.37-0ubuntu5.3+esm5"
        },
        {
            "binary_name": "bluez-hcidump",
            "binary_version": "5.37-0ubuntu5.3+esm5"
        },
        {
            "binary_name": "bluez-obexd",
            "binary_version": "5.37-0ubuntu5.3+esm5"
        },
        {
            "binary_name": "bluez-tests",
            "binary_version": "5.37-0ubuntu5.3+esm5"
        },
        {
            "binary_name": "libbluetooth3",
            "binary_version": "5.37-0ubuntu5.3+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json"

Ubuntu:Pro:18.04:LTS

bluez

Package

Name: bluez
Purl: pkg:deb/ubuntu/bluez?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.46-0ubuntu3

5.46-0ubuntu4

5.48-0ubuntu3

5.48-0ubuntu3.1

5.48-0ubuntu3.2

5.48-0ubuntu3.3

5.48-0ubuntu3.4

5.48-0ubuntu3.5

5.48-0ubuntu3.6

5.48-0ubuntu3.7

5.48-0ubuntu3.8

5.48-0ubuntu3.9

5.48-0ubuntu3.9+esm1

5.48-0ubuntu3.9+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bluetooth",
            "binary_version": "5.48-0ubuntu3.9+esm2"
        },
        {
            "binary_name": "bluez",
            "binary_version": "5.48-0ubuntu3.9+esm2"
        },
        {
            "binary_name": "bluez-cups",
            "binary_version": "5.48-0ubuntu3.9+esm2"
        },
        {
            "binary_name": "bluez-hcidump",
            "binary_version": "5.48-0ubuntu3.9+esm2"
        },
        {
            "binary_name": "bluez-obexd",
            "binary_version": "5.48-0ubuntu3.9+esm2"
        },
        {
            "binary_name": "bluez-tests",
            "binary_version": "5.48-0ubuntu3.9+esm2"
        },
        {
            "binary_name": "libbluetooth3",
            "binary_version": "5.48-0ubuntu3.9+esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-37577.json"