A new Debian Linux update has been published: DSA 4647-1: bluez security update
A bluez security update has been released for both Debian GNU/Linux 9 and 10 to fix an issue that BlueZ's HID and HOGP profile implementations don't specifically require bonding between the device and the host.Read more @ Linux Compatible