CVE-2023-45866

🗓️ 08 Dec 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 769 Views

CVE-2023-45866 Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue

Reporter	Title	Published	Views	Family All 132
GithubExploit	Exploit for Improper Authentication in Google Android	25 Jun 202617:50	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	31 May 202617:29	–	githubexploit
GithubExploit	bleak	16 May 202618:42	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	15 Dec 202403:00	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	27 Mar 202513:54	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	20 Dec 202417:28	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	16 Jan 202407:44	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	15 Jul 202609:24	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	8 Jan 202400:20	–	githubexploit
IBM Security Bulletins	Security Bulletin: Vulnerability in BlueZ affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	13 Mar 202517:32	–	ibm

NVD

Node

AND

google androidMatch4.2.2

bluproducts dashMatch3.5

Node

AND

google androidMatch6.0.1

google nexus_5Match-

Node

AND

google androidMatch10.0

google androidMatch11.0

google pixel_2Match-

Node

AND

google androidMatch13.0

google pixel_4aMatch-

google pixel_6Match-

Node

AND

google androidMatch14.0

google pixel_7Match-

Node

canonical ubuntu_linuxMatch18.04lts

canonical ubuntu_linuxMatch20.04-

canonical ubuntu_linuxMatch22.04lts

canonical ubuntu_linuxMatch23.10

Node

AND

apple iphone_osMatch16.6

apple iphone_seMatch-

Node

AND

apple macosMatch12.6.7

apple macbook_airMatch2017

Node

AND

apple macosMatch13.3.3

apple macbook_proMatchm2

Node

fedoraproject fedoraMatch38

fedoraproject fedoraMatch39

Node

apple ipadosRange<17.2

apple iphone_osRange<17.2

apple macosRange14.0–14.2

Node

debian debian_linuxMatch10.0

Source	Link
seclists	www.seclists.org/fulldisclosure/2023/Dec/9
support	www.support.apple.com/kb/HT214036
seclists	www.seclists.org/fulldisclosure/2023/Dec/7
git	www.git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/
security	www.security.gentoo.org/glsa/202401-03
support	www.support.apple.com/kb/HT214035
github	www.github.com/skysafe/reblog/tree/main/cve-2023-45866
changelogs	www.changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/