bluez: CVE-2020-0556

Debian Bug report logs - #953770
bluez: CVE-2020-0556

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: bluez: CVE-2020-0556

Date: Fri, 13 Mar 2020 10:41:37 +0100

Source: bluez
Version: 5.50-1
Severity: grave
Tags: security upstream
Justification: user security hole
Control: found -1 5.52-1

Hi,

The following vulnerability was published for bluez.

CVE-2020-0556[0]:
| Improper access control in subsystem for BlueZ before version 5.53 may
| allow an unauthenticated user to potentially enable escalation of
| privilege and denial of service via adjacent access.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-0556
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0556
[1] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00352.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 953770@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 953770@bugs.debian.org

Cc: Debian Security Team <team@security.debian.org>

Subject: bluez: diff for NMU version 5.50-1.1

Date: Sat, 14 Mar 2020 09:15:19 +0100

[Message part 1 (text/plain, inline)]

Control: tags 953770 + patch
Control: tags 953770 + pending


Dear maintainer,

I've prepared an NMU for bluez (versioned as 5.50-1.1) and
uploaded it to DELAYED/5. Please feel free to tell me if I
should delay it longer.

I decided to not explicitly change the default set for the new
configuration option (ClassicBondedOnly) which defaults to false
in the patchset, and which actually allows to make sure that input
connections come from bonded device connectsion.

Not sure if we should actually change this, CC'ing the security team
alias for further comments.

Regards,
Salvatore

[bluez-5.50-1.1-nmu.diff (text/x-diff, attachment)]

Send a report that this bug log contains spam.