{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos7els/vex/2021/cve-2021-3658-els_os-centos7els.json" } ], "tracking": { "current_release_date": "2026-06-12T15:35:40Z", "generator": { "date": "2026-06-12T15:35:40Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2021-3658-ELS_OS-CENTOS7ELS", "initial_release_date": "2021-01-01T00:00:00Z", "revision_history": [ { "date": "2021-01-01T00:00:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-06-12T15:35:40Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2021-3658" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" }, { "branches": [ { "category": "product_version", "name": "bluez-0:5.44-7.el7.x86_64", "product": { "name": "bluez-0:5.44-7.el7.x86_64", "product_id": "bluez-0:5.44-7.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/bluez@5.44-7.el7?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-libs-0:5.44-7.el7.x86_64", "product": { "name": "bluez-libs-0:5.44-7.el7.x86_64", "product_id": "bluez-libs-0:5.44-7.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/bluez-libs@5.44-7.el7?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-cups-0:5.44-7.el7.x86_64", "product": { "name": "bluez-cups-0:5.44-7.el7.x86_64", "product_id": "bluez-cups-0:5.44-7.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/bluez-cups@5.44-7.el7?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-libs-devel-0:5.44-7.el7.x86_64", "product": { "name": "bluez-libs-devel-0:5.44-7.el7.x86_64", "product_id": "bluez-libs-devel-0:5.44-7.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/bluez-libs-devel@5.44-7.el7?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-hid2hci-0:5.44-7.el7.x86_64", "product": { "name": "bluez-hid2hci-0:5.44-7.el7.x86_64", "product_id": "bluez-hid2hci-0:5.44-7.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/bluez-hid2hci@5.44-7.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "bluez-libs-0:5.44-7.el7.i686", "product": { "name": "bluez-libs-0:5.44-7.el7.i686", "product_id": "bluez-libs-0:5.44-7.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/bluez-libs@5.44-7.el7?arch=i686" } } }, { "category": "product_version", "name": "bluez-libs-devel-0:5.44-7.el7.i686", "product": { "name": "bluez-libs-devel-0:5.44-7.el7.i686", "product_id": "bluez-libs-devel-0:5.44-7.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/bluez-libs-devel@5.44-7.el7?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "bluez-0:5.44-7.el7.tuxcare.els1.x86_64", "product": { "name": "bluez-0:5.44-7.el7.tuxcare.els1.x86_64", "product_id": "bluez-0:5.44-7.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bluez@5.44-7.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64", "product": { "name": "bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64", "product_id": "bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bluez-libs@5.44-7.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64", "product": { "name": "bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64", "product_id": "bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bluez-cups@5.44-7.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64", "product": { "name": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64", "product_id": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bluez-libs-devel@5.44-7.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64", "product": { "name": "bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64", "product_id": "bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bluez-hid2hci@5.44-7.el7.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "bluez-libs-0:5.44-7.el7.tuxcare.els1.i686", "product": { "name": "bluez-libs-0:5.44-7.el7.tuxcare.els1.i686", "product_id": "bluez-libs-0:5.44-7.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bluez-libs@5.44-7.el7.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686", "product": { "name": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686", "product_id": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bluez-libs-devel@5.44-7.el7.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "bluez-0:5.44-7.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-0:5.44-7.el7.tuxcare.els1.x86_64" }, "product_reference": "bluez-0:5.44-7.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-0:5.44-7.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-0:5.44-7.el7.x86_64" }, "product_reference": "bluez-0:5.44-7.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64" }, "product_reference": "bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-0:5.44-7.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-0:5.44-7.el7.x86_64" }, "product_reference": "bluez-libs-0:5.44-7.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-0:5.44-7.el7.tuxcare.els1.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.i686" }, "product_reference": "bluez-libs-0:5.44-7.el7.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-0:5.44-7.el7.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-0:5.44-7.el7.i686" }, "product_reference": "bluez-libs-0:5.44-7.el7.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64" }, "product_reference": "bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-cups-0:5.44-7.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-cups-0:5.44-7.el7.x86_64" }, "product_reference": "bluez-cups-0:5.44-7.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64" }, "product_reference": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-devel-0:5.44-7.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-devel-0:5.44-7.el7.x86_64" }, "product_reference": "bluez-libs-devel-0:5.44-7.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686" }, "product_reference": "bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-libs-devel-0:5.44-7.el7.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-libs-devel-0:5.44-7.el7.i686" }, "product_reference": "bluez-libs-devel-0:5.44-7.el7.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64" }, "product_reference": "bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bluez-hid2hci-0:5.44-7.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bluez-hid2hci-0:5.44-7.el7.x86_64" }, "product_reference": "bluez-hid2hci-0:5.44-7.el7.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3658", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CentOS-7:bluez-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-0:5.44-7.el7.x86_64", "CentOS-7:bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-cups-0:5.44-7.el7.x86_64", "CentOS-7:bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-hid2hci-0:5.44-7.el7.x86_64", "CentOS-7:bluez-libs-0:5.44-7.el7.i686", "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.i686", "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-libs-0:5.44-7.el7.x86_64", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.i686", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-3658" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=1984728", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1984728" }, { "category": "external", "summary": "https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055", "url": "https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055" }, { "category": "external", "summary": "https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055", "url": "https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89", "url": "https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20220407-0002/", "url": "https://security.netapp.com/advisory/ntap-20220407-0002/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html", "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html" } ], "release_date": "2022-03-02T23:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-06-12T13:07:08.850617Z", "details": "This flaw only matters on systems that actually run BlueZ with a physical Bluetooth adapter and where the adapter had previously been set to Discoverable; by default adapters are non‑discoverable, cloud VMs don’t expose Bluetooth radios, and desktop hypervisors prevent guests from advertising or changing discoverability. The attack surface is limited to short‑range, adjacent attackers and the condition does not bypass pairing or provide code execution/integrity impact—it merely leaves the device visible. Given these constraints and that the state‑persistence bug was corrected upstream in BlueZ 5.61, this is a safe candidate for deprioritization in centrally managed server/VM fleets.", "product_ids": [ "CentOS-7:bluez-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-0:5.44-7.el7.x86_64", "CentOS-7:bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-cups-0:5.44-7.el7.x86_64", "CentOS-7:bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-hid2hci-0:5.44-7.el7.x86_64", "CentOS-7:bluez-libs-0:5.44-7.el7.i686", "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.i686", "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-libs-0:5.44-7.el7.x86_64", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.i686", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.x86_64" ] } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CentOS-7:bluez-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-0:5.44-7.el7.x86_64", "CentOS-7:bluez-cups-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-cups-0:5.44-7.el7.x86_64", "CentOS-7:bluez-hid2hci-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-hid2hci-0:5.44-7.el7.x86_64", "CentOS-7:bluez-libs-0:5.44-7.el7.i686", "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.i686", "CentOS-7:bluez-libs-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-libs-0:5.44-7.el7.x86_64", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.i686", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.i686", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.tuxcare.els1.x86_64", "CentOS-7:bluez-libs-devel-0:5.44-7.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }