5 ms·
Seems like the flag defaults to true since December 7 (Fedora 38) with bluez v5.70-4: $ rpm -q --changelog bluez | grep CVE-2023-45866 -C1 * Thu Dec 07
by fellerts 3y ago
Seems like the flag defaults to true since December 7 (Fedora 38) with bluez v5.70-4:
$ rpm -q --changelog bluez | grep CVE-2023-45866 -C1
* Thu Dec 07 2023 Peter Robinson <pbrobinson@fedoraproject.org> - 5.70-4
- Add mitigation for CVE-2023-45866
- jdfedgon 3y agoThis seems correct, however 'ClassicBondedOnly=true' is commented out in '/etc/bluetooth/input.conf' in Fedora 39 with bluez v5.70-4 anyways.
- cozzyd 3y agoGenerally commented out lines are defaults, right?
- creer 3y agoOften yes, but not always. Here both the default is mentioned and a commented line is offered (I like commented lines as they show a proper format). # Set idle timeout (in minutes) before the connection will # be disconnect (defaults to 0 for no timeout) #IdleTimeout=30
- maxerickson 3y agoPresumably so you can't turn it off simply by uncommenting the line. The default is defined in some source file.
- creer 3y agoMine says # Defaults to true for security. #ClassicBondedOnly=true (which is the patch indicated)
- maxerickson 3y agoI don't follow your point.
- creer 3y agoI was answering yours (perhaps reading it not the way you intended) and the grand parent's "HOWEVER 'ClassicBondedOnly=true' is commented out". No big deal. This style of option and comment and commenting out the option (default or not) is autopilot common - no special intent here.