CVEvulnerability
CVE-2023-45866
6.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-12-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.3 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-287
Description
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.
Affected configurations
• google android 4.2.2
• google android 6.0.1
• google android 10.0
• google android 11.0
• google android 13.0
• google android 14.0
• canonical ubuntu linux 18.04
• canonical ubuntu linux 20.04
• canonical ubuntu linux 22.04
• canonical ubuntu linux 23.10
• apple iphone os 16.6
• apple macos 12.6.7
• apple macos 13.3.3
• fedoraproject fedora 38
• fedoraproject fedora 39
• apple ipados (< 17.2)
• apple iphone os (< 17.2)
• apple macos (>= 14.0 < 14.2)
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog Release Notes
- http://seclists.org/fulldisclosure/2023/Dec/7 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Dec/9 Mailing List, Third Party Advisory
- https://bluetooth.com Not Applicable
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 Mailing List, Patch
- https://github.com/skysafe/reblog/tree/main/cve-2023-45866 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ Mailing List
- https://security.gentoo.org/glsa/202401-03 security.gentoo.org
- https://support.apple.com/kb/HT214035 Third Party Advisory
- https://support.apple.com/kb/HT214036 Third Party Advisory
- https://www.debian.org/security/2023/dsa-5584 www.debian.org
- http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog Release Notes
- http://seclists.org/fulldisclosure/2023/Dec/7 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Dec/9 Mailing List, Third Party Advisory
- https://bluetooth.com Not Applicable
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 Mailing List, Patch
- https://github.com/skysafe/reblog/tree/main/cve-2023-45866 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202401-03 security.gentoo.org
- https://support.apple.com/kb/HT214035 Third Party Advisory
- https://support.apple.com/kb/HT214036 Third Party Advisory
- https://www.debian.org/security/2023/dsa-5584 www.debian.org