DescriptionA bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs925369

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bluez (PTS)buster5.50-1.2~deb10u2vulnerable
buster (security)5.50-1.2~deb10u3vulnerable
bookworm, sid5.66-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[buster] - bluez <ignored> (Minor issue, invasive fix, workaround present in buster's gnome-bluetooth)
[stretch] - bluez <ignored> (Minor issue, does not affect Gnome Bluetooth in stretch)
[jessie] - bluez <no-dsa> (Minor issue because in gnome-bluetooth <= 3.26 the D-Bus calls were synchronous and thus the issue in bluez will have no actual affect)
Bug in src:bluez itself and would need fixing there, but it is workaroundable in
workaround in gnome-bluetooth landed in 3.28.2, BlueZ fixed in 5.51

Search for package or bug name: Reporting problems