Important: Booth Security Update for booth
Summary
ALSA-2024:3661: Important: booth security update. Affects booth versions < 1.1-1.el9_4.1. Fixed in 1.1-1.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Booth is a cluster ticket manager that facilitates high availability clusters spanning multiple sites. It acts as a distributed consensus-based service, operating on a separate physical network. Booth uses tickets as units of authorization, ensuring that resources are only run at one granted site at a time.
Vulnerability Detail
A specially crafted hash can lead to an invalid HMAC being accepted by the Booth server. This vulnerability is identified as CVE-2024-3049. An attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to resources managed by Booth.
How To Fix
Minimum fixed version
1.1-1.el9_4.1
This is the first release that contains the fix.
sudo dnf update boothTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
It is crucial to update the booth package to version 1.1-1.el9_4.1 or later to mitigate the risk of unauthorized access to Booth-managed resources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for booth →
FAQ
Booth is a cluster ticket manager that provides decision inputs to local Pacemaker cluster resource managers. It ensures that resources are run at only one granted site at a time.
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to resources managed by Booth.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability.
No, there are no known workarounds for this vulnerability.
You can find more information about this vulnerability in the CVE page: CVE-2024-3049.
Related vulnerabilities
Recent vulnerabilities recorded for booth.
