Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-3049: A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | booth | 0:1.0-8.ef769ef.git.amzn2.0.2 |
| Amazon Linux · 2 | booth-arbitrator | 0:1.0-8.ef769ef.git.amzn2.0.2 |
| Amazon Linux · 2 | booth-core | 0:1.0-8.ef769ef.git.amzn2.0.2 |
| Amazon Linux · 2 | booth-debuginfo | 0:1.0-8.ef769ef.git.amzn2.0.2 |
| Amazon Linux · 2 | booth-site | 0:1.0-8.ef769ef.git.amzn2.0.2 |
| Amazon Linux · 2 | booth-test | 0:1.0-8.ef769ef.git.amzn2.0.2 |
Vulnerabilities 1
-
Medium 5.9
Booth: specially crafted hash can lead to invalid hmac being accepted by booth server
A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-3049.html