CVE-2023-45866

🗓️ 08 Dec 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 625 Views

CVE-2023-45866 Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue

Reporter	Title	Published	Views	Family All 129
IBM Security Bulletins	Security Bulletin: Vulnerability in BlueZ affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	13 Mar 202517:32	–	ibm
GithubExploit	Exploit for Improper Authentication in Google Android	31 May 202617:29	–	githubexploit
GithubExploit	bleak	16 May 202618:42	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	15 Dec 202403:00	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	27 Mar 202513:54	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	20 Dec 202417:28	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	16 Jan 202407:44	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	8 Jan 202400:20	–	githubexploit
Tenable Nessus	Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2024-473)	8 Jan 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : bluez (ALAS-2024-2386)	9 Jan 202400:00	–	nessus

NVD

Node

google androidMatch4.2.2

AND

bluproducts dashMatch3.5

Node

google androidMatch6.0.1

AND

google nexus_5Match-

Node

google androidMatch10.0

google androidMatch11.0

AND

google pixel_2Match-

Node

google androidMatch13.0

AND

google pixel_4aMatch-

google pixel_6Match-

Node

google androidMatch14.0

AND

google pixel_7Match-

Node

canonical ubuntu_linuxMatch18.04lts

canonical ubuntu_linuxMatch20.04-

canonical ubuntu_linuxMatch22.04lts

canonical ubuntu_linuxMatch23.10

Node

apple iphone_osMatch16.6

AND

apple iphone_seMatch-

Node

apple macosMatch12.6.7

AND

apple macbook_airMatch2017

Node

apple macosMatch13.3.3

AND

apple macbook_proMatchm2

Node

fedoraproject fedoraMatch38

fedoraproject fedoraMatch39

Node

apple ipadosRange<17.2

apple iphone_osRange<17.2

apple macosRange14.0–14.2

Node

debian debian_linuxMatch10.0

Source	Link
seclists	www.seclists.org/fulldisclosure/2023/Dec/9
support	www.support.apple.com/kb/HT214036
seclists	www.seclists.org/fulldisclosure/2023/Dec/7
git	www.git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/
security	www.security.gentoo.org/glsa/202401-03
support	www.support.apple.com/kb/HT214035
github	www.github.com/skysafe/reblog/tree/main/cve-2023-45866
changelogs	www.changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/