High ALAS2023-2024-473 1 CVE

Important: bluez security update (Amazon Linux 2023)

Published Jan 3, 2024 · Updated Jan 8, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45866: bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution

Fixed packages 17

Release	Package	Fixed in
Amazon Linux · 2023	bluez	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-cups	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-cups-debuginfo	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-debuginfo	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-debugsource	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-deprecated	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-deprecated-debuginfo	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-hid2hci	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-hid2hci-debuginfo	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-libs	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-libs-debuginfo	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-libs-devel	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-libs-devel-debuginfo	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-mesh	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-mesh-debuginfo	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-obexd	0:5.62-2.amzn2023.0.5
Amazon Linux · 2023	bluez-obexd-debuginfo	0:5.62-2.amzn2023.0.5

Vulnerabilities 1

Unscored —

CVE-2023-45866 Public exploit

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encr…

bluez bluez bluez Debian Ubuntu Azure Linux

Dec 8, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-45866.html