CVSS: 5.9EPSS: 0%CPEs: 21EXPL: 1CVE-2024-3049 – Booth: specially crafted hash can lead to invalid hmac being accepted by booth server
https://notcve.org/view.php?id=CVE-2024-3049
06 Jun 2024 — A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server. Se encontró una falla en Booth, un administrador de tickets de clúster. Si se pasa un hash especialmente manipulado a gcry_md_get_algo_dlen(), es posible que el servidor Booth acepte un HMAC no válido. An update for booth is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterp... • https://github.com/truonghuuphuc/CVE-2024-30491-Poc • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-2553 – booth: authfile directive in booth config file is completely ignored.
https://notcve.org/view.php?id=CVE-2022-2553
28 Jul 2022 — The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster. La directiva authfile en el archivo de configuración de booth es ignorada, impidiendo el uso de la autenticación en las comunicaciones de nodo a nodo. Como resultando, los nodos que no presentan la clave de autenticación correcta no son impedido... • https://github.com/ClusterLabs/booth/commit/35bf0b7b048d715f671eb68974fb6b4af6528c67 • CWE-287: Improper Authentication •