Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

OSVersionArchitecturePackageVersionFilename
Debian12allbluez< 5.66-1+deb12u1bluez_5.66-1+deb12u1_all.deb
Debian11allbluez< 5.55-3.1+deb11u1bluez_5.55-3.1+deb11u1_all.deb
Debian10allbluez< 5.50-1.2~deb10u4bluez_5.50-1.2~deb10u4_all.deb
Debian999allbluez< 5.70-1.1bluez_5.70-1.1_all.deb
Debian13allbluez< 5.70-1.1bluez_5.70-1.1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	bluez	< 5.66-1+deb12u1	bluez_5.66-1+deb12u1_all.deb
Debian	11	all	bluez	< 5.55-3.1+deb11u1	bluez_5.55-3.1+deb11u1_all.deb
Debian	10	all	bluez	< 5.50-1.2~deb10u4	bluez_5.50-1.2~deb10u4_all.deb
Debian	999	all	bluez	< 5.70-1.1	bluez_5.70-1.1_all.deb
Debian	13	all	bluez	< 5.70-1.1	bluez_5.70-1.1_all.deb