CVE-2023-45866

Katalog CVE

CVSS 6.3 · Medium EPSS 7,9%

Kerentanan Improper Authentication pada google android, canonical ubuntu linux +5 lainnya. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Rincian

Terbit di NVD

8 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

7,9% peluang dieksploitasi; lebih tinggi dari 94,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085e... mailing list · patch
• http://seclists.org/fulldisclosure/2023/Dec/7 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Dec/9 mailing list · advisory pihak ketiga
• https://github.com/skysafe/reblog/tree/main/cve-2023-45866 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html mailing list · advisory pihak ketiga
• https://support.apple.com/kb/HT214035 advisory pihak ketiga
• https://support.apple.com/kb/HT214036 advisory pihak ketiga
• http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog release notes
• https://bluetooth.com not applicable
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7I... mailing list
• https://security.gentoo.org/glsa/202401-03
• https://www.debian.org/security/2023/dsa-5584
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/77YQQS5FXPYE6WB...
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2N2P5LMP3V7IJO...