31 lines
1.5 KiB
JSON
31 lines
1.5 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-10772",
|
|
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
|
|
"state": "REJECTED",
|
|
"dateReserved": "2026-06-03T15:44:05.350Z",
|
|
"dateUpdated": "2026-08-01T12:02:47.940Z",
|
|
"dateRejected": "2026-08-01T12:02:47.940Z",
|
|
"assignerShortName": "zephyr"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
|
|
"shortName": "zephyr",
|
|
"dateUpdated": "2026-08-01T12:02:47.940Z"
|
|
},
|
|
"rejectedReasons": [
|
|
{
|
|
"lang": "en",
|
|
"value": "** DUPLICATE ** This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to a vulnerability already covered by CVE-2026-2411, which was assigned earlier for the same defect: the Bluetooth GATT notify/indicate paths check the permissions of the Characteristic Declaration attribute rather than the Characteristic Value attribute, so the encryption/authentication requirements configured on the value are not enforced. Both identifiers describe the same root cause in subsys/bluetooth/host/gatt.c, fixed by the same commit (c3386f92fe81bd10dc23e6a115e6a80a7d863546). Use CVE-2026-2411 instead."
|
|
}
|
|
],
|
|
"replacedBy": [
|
|
"CVE-2026-2411"
|
|
]
|
|
}
|
|
}
|
|
} |