Important: bluez

2024-01-0321:04:00

alas.aws.amazon.com

bluez

unauthorized device connections

keystroke injection

command execution

cve-2023-45866

amazon linux 2

update

package

security advisory

6.3 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.5%

JSON

Issue Overview:

bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)

Affected Packages:

bluez

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update bluez to update your system.

New Packages:

aarch64:  
    bluez-5.44-7.amzn2.0.4.aarch64  
    bluez-libs-5.44-7.amzn2.0.4.aarch64  
    bluez-libs-devel-5.44-7.amzn2.0.4.aarch64  
    bluez-cups-5.44-7.amzn2.0.4.aarch64  
    bluez-hid2hci-5.44-7.amzn2.0.4.aarch64  
    bluez-debuginfo-5.44-7.amzn2.0.4.aarch64  
  
i686:  
    bluez-5.44-7.amzn2.0.4.i686  
    bluez-libs-5.44-7.amzn2.0.4.i686  
    bluez-libs-devel-5.44-7.amzn2.0.4.i686  
    bluez-cups-5.44-7.amzn2.0.4.i686  
    bluez-hid2hci-5.44-7.amzn2.0.4.i686  
    bluez-debuginfo-5.44-7.amzn2.0.4.i686  
  
src:  
    bluez-5.44-7.amzn2.0.4.src  
  
x86_64:  
    bluez-5.44-7.amzn2.0.4.x86_64  
    bluez-libs-5.44-7.amzn2.0.4.x86_64  
    bluez-libs-devel-5.44-7.amzn2.0.4.x86_64  
    bluez-cups-5.44-7.amzn2.0.4.x86_64  
    bluez-hid2hci-5.44-7.amzn2.0.4.x86_64  
    bluez-debuginfo-5.44-7.amzn2.0.4.x86_64

Additional References

Red Hat: CVE-2023-45866

Mitre: CVE-2023-45866

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64bluez< 5.44-7.amzn2.0.4bluez-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux2aarch64bluez-libs< 5.44-7.amzn2.0.4bluez-libs-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux2aarch64bluez-libs-devel< 5.44-7.amzn2.0.4bluez-libs-devel-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux2aarch64bluez-cups< 5.44-7.amzn2.0.4bluez-cups-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux2aarch64bluez-hid2hci< 5.44-7.amzn2.0.4bluez-hid2hci-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux2aarch64bluez-debuginfo< 5.44-7.amzn2.0.4bluez-debuginfo-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux2i686bluez< 5.44-7.amzn2.0.4bluez-5.44-7.amzn2.0.4.i686.rpm
Amazon Linux2i686bluez-libs< 5.44-7.amzn2.0.4bluez-libs-5.44-7.amzn2.0.4.i686.rpm
Amazon Linux2i686bluez-libs-devel< 5.44-7.amzn2.0.4bluez-libs-devel-5.44-7.amzn2.0.4.i686.rpm
Amazon Linux2i686bluez-cups< 5.44-7.amzn2.0.4bluez-cups-5.44-7.amzn2.0.4.i686.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	bluez	< 5.44-7.amzn2.0.4	bluez-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux	2	aarch64	bluez-libs	< 5.44-7.amzn2.0.4	bluez-libs-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux	2	aarch64	bluez-libs-devel	< 5.44-7.amzn2.0.4	bluez-libs-devel-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux	2	aarch64	bluez-cups	< 5.44-7.amzn2.0.4	bluez-cups-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux	2	aarch64	bluez-hid2hci	< 5.44-7.amzn2.0.4	bluez-hid2hci-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux	2	aarch64	bluez-debuginfo	< 5.44-7.amzn2.0.4	bluez-debuginfo-5.44-7.amzn2.0.4.aarch64.rpm
Amazon Linux	2	i686	bluez	< 5.44-7.amzn2.0.4	bluez-5.44-7.amzn2.0.4.i686.rpm
Amazon Linux	2	i686	bluez-libs	< 5.44-7.amzn2.0.4	bluez-libs-5.44-7.amzn2.0.4.i686.rpm
Amazon Linux	2	i686	bluez-libs-devel	< 5.44-7.amzn2.0.4	bluez-libs-devel-5.44-7.amzn2.0.4.i686.rpm
Amazon Linux	2	i686	bluez-cups	< 5.44-7.amzn2.0.4	bluez-cups-5.44-7.amzn2.0.4.i686.rpm