NetSight
IP …
high8.1

CVE-2019-9506

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influen…

Impact

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Affected products

VendorProductAffected versions
GoogleAndroid
All versions
AppleIphone Os
Version 12.4
AppleMac Os X
Versions 10.12.6, 10.13.6, 10.14.5
AppleTvos
Version 12.4
AppleWatchos
Version 5.3
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04
DebianDebian Linux
Version 8.0
OpensuseLeap
Versions 15.0, 15.1
RedhatMrg Realtime
Version 2.0
RedhatVirtualization Host Eus
Version 4.2
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Aus
Version 7.5

Weakness classification

CWE-310CWE-327

References