Critical Security Update for Booth Package: CVE-2022-2553
Summary
RHSA-2022:6439: Red Hat Security Advisory: booth security update. Affects booth versions < 0:1.0-199.1.ac1d34c.git.el8_6.1. Fixed in 0:1.0-199.1.ac1d34c.git.el8_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Booth package is a high-availability tool designed for managing cluster resources in Red Hat Enterprise Linux environments. It facilitates the coordination of cluster nodes to ensure consistent and reliable service availability. The package is integral to maintaining system resilience and performance, particularly in environments requiring high uptime. However, it has been identified to have a security vulnerability that could potentially compromise system integrity.
Vulnerability Detail
CVE-2022-2553 is a vulnerability found in the Booth package, which could allow unauthorized access or manipulation of cluster resources. This vulnerability arises from insufficient validation of input data, leading to potential exploitation by attackers. The ramifications of this vulnerability include unauthorized access to sensitive data, disruption of service, and potential system compromise. The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk that should be addressed promptly.
How To Fix
Minimum fixed version
0:1.0-199.1.ac1d34c.git.el8_6.1
This is the first release that contains the fix.
sudo dnf update boothTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Booth service by implementing firewall rules that limit connections to trusted IP addresses only. This can help mitigate the risk until the package is updated. Example command:
sudo firewall-cmd --add-rich-rule="rule family='ipv4' source address='trusted_ip' accept"'.
Conclusion
The CVE-2022-2553 vulnerability in the Booth package poses a moderate risk to systems relying on high availability. It is crucial to update to the patched version to mitigate potential security threats. Implementing temporary workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for booth →
FAQ
CVE-2022-2553 is a security vulnerability in the Booth package that could allow unauthorized access to cluster resources.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Implement firewall rules to restrict access to the Booth service as a temporary workaround until you can apply the update.
The vulnerability could lead to unauthorized access, data manipulation, and disruption of services within your cluster environment.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2022:6439.json.
Related vulnerabilities
Recent vulnerabilities recorded for booth.
