Description
The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Booth | Booth versions after v1.0-85-gda79b8b are vulnerable. Resolved in booth v1.0-263-g35bf0b7. | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | booth | 1.0-268-gdce51f9-1 | — |
| Debian 13 | booth | 1.0-268-gdce51f9-1 | — |
| Debian 12 | booth | 1.0-268-gdce51f9-1 | — |
| Debian 11 | booth | 1.0-237-gdd88847-2+deb11u1 | DSA-5194-1 |
| Debian 10 | booth | 1.0-162-g27f917f-2+deb10u1 | DSA-5194-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | booth | No fix yet | — |
| Ubuntu 22.04 LTS | booth | 1.0-237-gdd88847-4ubuntu2.2 | USN-5556-1 |
| Ubuntu 20.04 LTS | booth | 1.0-174-gce9f821-1ubuntu0.2 | USN-5556-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | booth +4 | 1.0-251.3.bfb2f92.git.el9_0.1 | RHSA-2022:6580 |
| RHEL 8 | booth +4 | 1.0-199.1.ac1d34c.git.el8_6.1 | RHSA-2022:6439 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.4 EUS | booth +4 | 1.0-199.1.ac1d34c.git.el8_4.1 | RHSA-2022:6250 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | booth +4 | 1.0-251.3.bfb2f92.git.el9_0.1 | ALSA-2022:6580 |
| AlmaLinux 8 | booth +4 | 1.0-199.1.ac1d34c.git.el8_6.1 | ALSA-2022:6439 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | booth | 1.0-199.1.ac1d34c.git.el8_6.1 | RLSA-2022:6439 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | booth | 1.0+20210519.bfb2f92-150400.3.3.1 | SUSE-SU-2022:2609-1 |
| SLES 15 SP3 | booth | 1.0-150300.18.3.1 | SUSE-SU-2022:2608-1 |
| SLES 15 SP2 | booth | 1.0-150100.11.3.1 | SUSE-SU-2022:2606-1 |
| SLES 15 SP1 | booth | 1.0-150100.11.3.1 | SUSE-SU-2022:2606-1 |
| SLES 15 | booth | 1.0-150000.6.3.1 | SUSE-SU-2022:2607-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | booth | 1.0-42.3.1 | SUSE-SU-2022:2605-1 |
| SLES 12 SP4 | booth | 1.0-42.3.1 | SUSE-SU-2022:2605-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | booth | 1.0+20220724.dce51f9-1.1 | openSUSE-SU-2024:12315-1 |
| openSUSE Leap 15.4 | booth | 1.0+20210519.bfb2f92-150400.3.3.1 | SUSE-SU-2022:2609-1 |
| openSUSE Leap 15.3 | booth | 1.0-150300.18.3.1 | SUSE-SU-2022:2608-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | booth +4 | 1.0-8.ef769ef.git.amzn2.0.1 | ALAS2-2023-2009 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | booth | 1.0-8 | — |
| Azure Linux 2 (CBL-Mariner) | booth | 1.0-8 | — |
Advisories 15
- ALSA-2022:6580 Moderate: booth security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:6439 Moderate: booth security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:6580 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:6439 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:6250 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-5556-1 booth vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5194-1 booth - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:6439 Moderate: booth security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:12315-1 booth-1.0+20220724.dce51f9-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2608-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2606-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2605-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2607-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2609-1 Security update for booth SUSE / openSUSE Security Updates · May 2, 2025
- ALAS2-2023-2009 Moderate: booth security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 4, 2023
References
- https://github.com/ClusterLabs/booth/commit/35bf0b7b048d715f671eb68974fb6b4af6528c67
- DSA-5194 vendor-advisory
- FEDORA-2022-e0a87993b8 vendor-advisory
- FEDORA-2022-6744980220 vendor-advisory