Medium USN-8832-1 1 CVE

booth vulnerability

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Booth did not properly validate message
authentication codes under certain circumstances. A remote attacker
could possibly use this issue to bypass authentication.

Fixed packages 4

Release	Package	Fixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	booth	1.0-6ubuntu1+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS	booth	1.0-174-gce9f821-1ubuntu0.2+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS	booth	1.0-237-gdd88847-4ubuntu2.2+esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS	booth	1.1-1ubuntu4+esm1

Vulnerabilities 1

Medium 5.9

CVE-2024-3049

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

Jun 6, 2024

References

report
https://ubuntu.com/security/CVE-2024-3049