-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.3754
                           bluez security update
                             10 November 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           bluez
Publisher:         Red Hat
Operating System:  Red Hat
Impact/Access:     Provide Misleading Information -- Remote/Unauthenticated
                   Access Confidential Data       -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-26558  

Reference:         ESB-2021.2248
                   ESB-2021.2145

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2021:4432

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: bluez security update
Advisory ID:       RHSA-2021:4432-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:4432
Issue date:        2021-11-09
CVE Names:         CVE-2020-26558 
=====================================================================

1. Summary:

An update for bluez is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

The bluez packages contain the following utilities for use in Bluetooth
applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start
scripts (Red Hat), and pcmcia configuration files. 

Security Fix(es):

* bluez: Passkey Entry protocol of the Bluetooth Core is vulnerable to an
impersonation attack (CVE-2020-26558)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1918602 - CVE-2020-26558 bluez: Passkey Entry protocol of the Bluetooth Core is vulnerable to an impersonation attack

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

aarch64:
bluez-cups-5.56-1.el8.aarch64.rpm
bluez-cups-debuginfo-5.56-1.el8.aarch64.rpm
bluez-debuginfo-5.56-1.el8.aarch64.rpm
bluez-debugsource-5.56-1.el8.aarch64.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.aarch64.rpm
bluez-libs-debuginfo-5.56-1.el8.aarch64.rpm
bluez-obexd-debuginfo-5.56-1.el8.aarch64.rpm

ppc64le:
bluez-cups-5.56-1.el8.ppc64le.rpm
bluez-cups-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-debugsource-5.56-1.el8.ppc64le.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-libs-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-obexd-debuginfo-5.56-1.el8.ppc64le.rpm

s390x:
bluez-cups-5.56-1.el8.s390x.rpm
bluez-cups-debuginfo-5.56-1.el8.s390x.rpm
bluez-debuginfo-5.56-1.el8.s390x.rpm
bluez-debugsource-5.56-1.el8.s390x.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.s390x.rpm
bluez-libs-debuginfo-5.56-1.el8.s390x.rpm
bluez-obexd-debuginfo-5.56-1.el8.s390x.rpm

x86_64:
bluez-cups-5.56-1.el8.x86_64.rpm
bluez-cups-debuginfo-5.56-1.el8.x86_64.rpm
bluez-debuginfo-5.56-1.el8.x86_64.rpm
bluez-debugsource-5.56-1.el8.x86_64.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.x86_64.rpm
bluez-libs-debuginfo-5.56-1.el8.x86_64.rpm
bluez-obexd-debuginfo-5.56-1.el8.x86_64.rpm

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
bluez-5.56-1.el8.src.rpm

aarch64:
bluez-5.56-1.el8.aarch64.rpm
bluez-cups-debuginfo-5.56-1.el8.aarch64.rpm
bluez-debuginfo-5.56-1.el8.aarch64.rpm
bluez-debugsource-5.56-1.el8.aarch64.rpm
bluez-hid2hci-5.56-1.el8.aarch64.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.aarch64.rpm
bluez-libs-5.56-1.el8.aarch64.rpm
bluez-libs-debuginfo-5.56-1.el8.aarch64.rpm
bluez-obexd-5.56-1.el8.aarch64.rpm
bluez-obexd-debuginfo-5.56-1.el8.aarch64.rpm

ppc64le:
bluez-5.56-1.el8.ppc64le.rpm
bluez-cups-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-debugsource-5.56-1.el8.ppc64le.rpm
bluez-hid2hci-5.56-1.el8.ppc64le.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-libs-5.56-1.el8.ppc64le.rpm
bluez-libs-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-obexd-5.56-1.el8.ppc64le.rpm
bluez-obexd-debuginfo-5.56-1.el8.ppc64le.rpm

s390x:
bluez-5.56-1.el8.s390x.rpm
bluez-cups-debuginfo-5.56-1.el8.s390x.rpm
bluez-debuginfo-5.56-1.el8.s390x.rpm
bluez-debugsource-5.56-1.el8.s390x.rpm
bluez-hid2hci-5.56-1.el8.s390x.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.s390x.rpm
bluez-libs-5.56-1.el8.s390x.rpm
bluez-libs-debuginfo-5.56-1.el8.s390x.rpm
bluez-obexd-5.56-1.el8.s390x.rpm
bluez-obexd-debuginfo-5.56-1.el8.s390x.rpm

x86_64:
bluez-5.56-1.el8.x86_64.rpm
bluez-cups-debuginfo-5.56-1.el8.i686.rpm
bluez-cups-debuginfo-5.56-1.el8.x86_64.rpm
bluez-debuginfo-5.56-1.el8.i686.rpm
bluez-debuginfo-5.56-1.el8.x86_64.rpm
bluez-debugsource-5.56-1.el8.i686.rpm
bluez-debugsource-5.56-1.el8.x86_64.rpm
bluez-hid2hci-5.56-1.el8.x86_64.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.i686.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.x86_64.rpm
bluez-libs-5.56-1.el8.i686.rpm
bluez-libs-5.56-1.el8.x86_64.rpm
bluez-libs-debuginfo-5.56-1.el8.i686.rpm
bluez-libs-debuginfo-5.56-1.el8.x86_64.rpm
bluez-obexd-5.56-1.el8.x86_64.rpm
bluez-obexd-debuginfo-5.56-1.el8.i686.rpm
bluez-obexd-debuginfo-5.56-1.el8.x86_64.rpm

Red Hat Enterprise Linux CRB (v. 8):

aarch64:
bluez-cups-debuginfo-5.56-1.el8.aarch64.rpm
bluez-debuginfo-5.56-1.el8.aarch64.rpm
bluez-debugsource-5.56-1.el8.aarch64.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.aarch64.rpm
bluez-libs-debuginfo-5.56-1.el8.aarch64.rpm
bluez-libs-devel-5.56-1.el8.aarch64.rpm
bluez-obexd-debuginfo-5.56-1.el8.aarch64.rpm

ppc64le:
bluez-cups-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-debugsource-5.56-1.el8.ppc64le.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-libs-debuginfo-5.56-1.el8.ppc64le.rpm
bluez-libs-devel-5.56-1.el8.ppc64le.rpm
bluez-obexd-debuginfo-5.56-1.el8.ppc64le.rpm

s390x:
bluez-cups-debuginfo-5.56-1.el8.s390x.rpm
bluez-debuginfo-5.56-1.el8.s390x.rpm
bluez-debugsource-5.56-1.el8.s390x.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.s390x.rpm
bluez-libs-debuginfo-5.56-1.el8.s390x.rpm
bluez-libs-devel-5.56-1.el8.s390x.rpm
bluez-obexd-debuginfo-5.56-1.el8.s390x.rpm

x86_64:
bluez-cups-debuginfo-5.56-1.el8.i686.rpm
bluez-cups-debuginfo-5.56-1.el8.x86_64.rpm
bluez-debuginfo-5.56-1.el8.i686.rpm
bluez-debuginfo-5.56-1.el8.x86_64.rpm
bluez-debugsource-5.56-1.el8.i686.rpm
bluez-debugsource-5.56-1.el8.x86_64.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.i686.rpm
bluez-hid2hci-debuginfo-5.56-1.el8.x86_64.rpm
bluez-libs-debuginfo-5.56-1.el8.i686.rpm
bluez-libs-debuginfo-5.56-1.el8.x86_64.rpm
bluez-libs-devel-5.56-1.el8.i686.rpm
bluez-libs-devel-5.56-1.el8.x86_64.rpm
bluez-obexd-debuginfo-5.56-1.el8.i686.rpm
bluez-obexd-debuginfo-5.56-1.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-26558
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYYrdt9zjgjWX9erEAQj3Kg//RFuvdDqQfdw3Wm00uS+qmxOaUzvG5OVO
XrSpoMb5VcrJRKTBY3u4ObfU1+yGJ5iF2wGwxgu6QF4tLUwC/OPSCgvS0lifTcEy
OkvBnkR06tBsGTjBmN8wyHQTEGVdFLlFU+sbC+yKjHmF31o6ZgDD7VZV/wuzqSGk
ZPR39CzfnnnTzLz2QvrYJZZ/tpgvS5qOTebP/qEmQCuwmRJeTaY+pgj28e8njQjU
NMqAcR7/kPX6LIYzdhQgEOCWZ9imxjoYAwY/VMu9T23zuyTkRTQtCC8Q5GJgATRV
qD4adxIeyJSvvMzJf6VkvzXu32AWira9oFgFPiYwjEYVJcMmGKZGJx94a1mu2Rs8
TFi3+iuVAdHE1S9NJ54nfxkjnVs6XKDIITNIZkl+isfQEtkkUBfeVcK6U/57wCKN
jgvUtrcQpqNH86x3Uu4W//eFlXQrbfzsogDx10d/jSk+PPg60mP6Fzcad8PTgr/H
vZygkT1bLbY7lOXejiVnJ8+otIv7tK+XzajDvQwgwC+9IigncMygiSS0SelVht4U
rvdqIKs2btFOBk+GhUzEMogaGFDqRUpFKIEFFVtL6d3Uvr4rgDHjMewKdU9v11ED
94Cg3wX0XFYvrnRS1Lxx9m1vuWtevD4EyZLSxcAEMLSXEMoa2c8f7Y6gxb7PGAKb
irY79RTeDm4=
=R6rn
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYYs8AeNLKJtyKPYoAQgVoA//Zr6fnROkiEqgQ3XYhezz6V9D2Z2C95ER
q+LzvLaoXfJJ3zFldcgxz6H2eafIBPJPbAa4x55jJcNZJ+Y4Y+Rab0ZdUf0Jp6OR
ZcJJukHmJFQPW+EW1eKFqTnP41pcotkVKU9Myh9djp1va+U0WGPEJwV2OAEp2FBM
nuKix6Brfo4sbxevXQviD70SsjCGd+RCeGESOD9F3GAZbLFxeO7YV+pi82DzbGuA
s7tsgMx9geQL8kEX8NJ48ExpTxND9KLVP+1nUTttIVD4DCtekrkkoyK7xLVCWf4f
VhNExNuePO3MsYiCAVir0nc8VvbPH0wja57JCYN92/zQvYP7ZjXpYUswm64vaxzL
J/HsT13jat/RKpkyqSngdEelZ+PyCWfZHpB4KXN7B1Yg9xU1/NiE7Yx3feeHPjY7
5hoPJCXvsnRkUyLx2e6NNVgJdnin6304Jx3JLHQSTxJZbjDJ7INuYeS29uDvqHNz
Ok21pxdqS8JMv1A+eh4GZAjMfm1BPWIzqnM4aUHipqm2bRKcLElUIOO7d4tXPuh0
iB+1TU8EZ07dkUxFJasmzBUofXEXYI8DvkCclI1iyW4tcqSASYAQWE9BaOAamXgG
kIL+hBSXn7aEyADsHr9L7ccpUyZQ1Qq18DoEUO7mneuC9iSPa0cC+7BhkeBe1Q8N
EiNPN+5S7wA=
=vPXs
-----END PGP SIGNATURE-----