[Debian] High CVE: CVE-2023-45866 bluez: permit an unauthenticated Peripheral role

[Yue Tao]

CVE-2023-45866: https://nvd.nist.gov/vuln/detail/CVE-2023-45866

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Base Score: High

Reference:

['libbluetooth3_5.55-3.1_amd64.deb===>libbluetooth3_5.55-3.1+deb11u1_amd64.deb']
https://www.debian.org/security/2023/dsa-5584

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/904419

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/904419
Committed: https://opendev.org/starlingx/tools/commit/18969517c986adc7aab2156d067184f56dc788e9
Submitter: "Zuul (22348)"
Branch: master

commit 18969517c986adc7aab2156d067184f56dc788e9
Author: Zhixiong Chi <email address hidden>
Date: Thu Dec 21 21:53:37 2023 -0800

    libbluetooth3: Upgrade to 5.55-3.1+deb11u1

    Upgrade subpackages libbluetooth3 and libbluetooth-dev to
    5.55-3.1+deb11u1 to fix the CVE issue CVE-2023-45866.
    Add libbluetooth-dev since it's the dependency of python3.9.

    Refer to:
    https://www.debian.org/security/2023/dsa-5584
    https://security-tracker.debian.org/tracker/CVE-2023-45866

    TestPlan:
    PASS: downloader; build-pkgs -c; build-image
    PASS: Jenkins Installation

    Closes-Bug: 2047185

    Signed-off-by: Zhixiong Chi <email address hidden>
    Change-Id: Id4175c0ef5791dbc02fa546a6b0a21a64cfec711