CVE-2023-45866

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45866
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

6.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog Release Notes
http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog Release Notes
http://seclists.org/fulldisclosure/2023/Dec/7 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Dec/7 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Dec/9 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Dec/9 Mailing List Third Party Advisory
https://bluetooth.com Not Applicable
https://bluetooth.com Not Applicable
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 Mailing List Patch
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 Mailing List Patch
https://github.com/skysafe/reblog/tree/main/cve-2023-45866 Third Party Advisory
https://github.com/skysafe/reblog/tree/main/cve-2023-45866 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ Mailing List
https://security.gentoo.org/glsa/202401-03
https://security.gentoo.org/glsa/202401-03
https://support.apple.com/kb/HT214035 Third Party Advisory
https://support.apple.com/kb/HT214035 Third Party Advisory
https://support.apple.com/kb/HT214036 Third Party Advisory
https://support.apple.com/kb/HT214036 Third Party Advisory
https://www.debian.org/security/2023/dsa-5584
https://www.debian.org/security/2023/dsa-5584
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*
cpe:2.3:h:bluproducts:dash:3.5:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
cpe:2.3:h:google:nexus_5:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
cpe:2.3:h:google:pixel_2:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
OR cpe:2.3:h:google:pixel_4a:-:*:*:*:*:*:*:*
cpe:2.3:h:google:pixel_6:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:h:google:pixel_7:-:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:23.10:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:apple:iphone_os:16.6:*:*:*:*:*:*:*
cpe:2.3:h:apple:iphone_se:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:apple:macos:12.6.7:*:*:*:*:*:*:*
cpe:2.3:h:apple:macbook_air:2017:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:apple:macos:13.3.3:*:*:*:*:*:*:*
cpe:2.3:h:apple:macbook_pro:m2:*:*:*:*:*:*:*

Configuration 10 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 11 (hide)

OR cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Configuration 12 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

12 Dec 2024, 14:33

Type Values Removed Values Added
CPE cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:* cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
First Time Apple ipados

05 Jan 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-03 -

22 Dec 2023, 01:15

Type Values Removed Values Added
References
  • () https://www.debian.org/security/2023/dsa-5584 -

18 Dec 2023, 18:41

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html - () https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html - Mailing List, Third Party Advisory
First Time Debian
Debian debian Linux
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 6.3

15 Dec 2023, 11:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html -

14 Dec 2023, 14:47

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:h:google:pixel_2:-:*:*:*:*:*:*:*
cpe:2.3:h:bluproducts:dash:3.5:*:*:*:*:*:*:*
cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:16.6:*:*:*:*:*:*:*
cpe:2.3:h:google:pixel_4a:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:23.10:*:*:*:*:*:*:*
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:12.6.7:*:*:*:*:*:*:*
cpe:2.3:h:google:nexus_5:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:h:apple:macbook_pro:m2:*:*:*:*:*:*:*
cpe:2.3:h:google:pixel_6:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:13.3.3:*:*:*:*:*:*:*
cpe:2.3:h:apple:macbook_air:2017:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
cpe:2.3:h:apple:iphone_se:-:*:*:*:*:*:*:*
cpe:2.3:h:google:pixel_7:-:*:*:*:*:*:*:*
References () http://seclists.org/fulldisclosure/2023/Dec/9 - () http://seclists.org/fulldisclosure/2023/Dec/9 - Mailing List, Third Party Advisory
References () https://support.apple.com/kb/HT214035 - () https://support.apple.com/kb/HT214035 - Third Party Advisory
References () https://support.apple.com/kb/HT214036 - () https://support.apple.com/kb/HT214036 - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ - Mailing List
References () http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog - () http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ - Mailing List
References () https://github.com/skysafe/reblog/tree/main/cve-2023-45866 - () https://github.com/skysafe/reblog/tree/main/cve-2023-45866 - Third Party Advisory
References () http://seclists.org/fulldisclosure/2023/Dec/7 - () http://seclists.org/fulldisclosure/2023/Dec/7 - Mailing List, Third Party Advisory
References () https://bluetooth.com - () https://bluetooth.com - Not Applicable
References () https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 - () https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 - Mailing List, Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-287
First Time Apple
Apple iphone Os
Apple macos
Google pixel 2
Fedoraproject fedora
Bluproducts
Apple macbook Pro
Canonical
Apple iphone Se
Fedoraproject
Bluproducts dash
Google nexus 5
Apple macbook Air
Google android
Canonical ubuntu Linux
Apple ipad Os
Google pixel 7
Google
Google pixel 6
Google pixel 4a

13 Dec 2023, 01:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2023/Dec/9 -
  • () http://seclists.org/fulldisclosure/2023/Dec/7 -

12 Dec 2023, 19:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214035 -

11 Dec 2023, 19:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214036 -

11 Dec 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77YQQS5FXPYE6WBBZO3REFIRAUJHERFA/ -

09 Dec 2023, 04:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/ -

08 Dec 2023, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-08 06:15

Updated : 2024-12-12 14:33

NVD link : CVE-2023-45866

Mitre link : CVE-2023-45866

JSON object : View

Products Affected

bluproducts

  • dash

debian

  • debian_linux

apple

  • macbook_air
  • ipados
  • iphone_se
  • macos
  • macbook_pro
  • iphone_os

fedoraproject

  • fedora

canonical

  • ubuntu_linux

google

  • nexus_5
  • pixel_7
  • pixel_2
  • pixel_6
  • android
  • pixel_4a
CWE
CWE-287

Improper Authentication