bt: mesh: vulnerability in provisioning protocol implementation on provisionee side

CVE-2023-4258

What is CVE-2023-4258?

A vulnerability exists in the Bluetooth mesh implementation of the Zephyr Project where a provisionee accepting a public key sent out-of-band may mistakenly accept it during the provisioning process. This could lead to potential risks in the provisioning security, allowing for unintended key acceptance and problems in establishing a secure connection.

References