Description
A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | booth | 1.0-283.1 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | booth | 1.1-2 | — |
| Debian 13 | booth | 1.1-2 | — |
| Debian 12 | booth | 1.0-283-g9d4029a-2+deb12u1 | DSA-5777-1 |
| Debian 11 | booth | 1.0-237-gdd88847-2+deb11u2 | DLA-3894-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | booth | No fix yet | — |
| Ubuntu 25.10 | booth | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | booth | 1.1-1ubuntu4+esm1 | USN-8832-1 |
| Ubuntu Pro 22.04 LTS | booth | 1.0-237-gdd88847-4ubuntu2.2+esm1 | USN-8832-1 |
| Ubuntu Pro 20.04 LTS | booth | 1.0-174-gce9f821-1ubuntu0.2+esm1 | USN-8832-1 |
| Ubuntu Pro 18.04 LTS | booth | 1.0-6ubuntu1+esm1 | USN-8832-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | booth +4 | 1.1-1.el9_4.1 | RHSA-2024:3661 |
| RHEL 8 | booth +4 | 1.1-1.el8_10.1 | RHSA-2024:3659 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | booth +4 | 1.0-283.1.9d4029a.git.el9_2.1 | RHSA-2024:3660 |
| RHEL 9.0 E4S | booth +4 | 1.0-251.3.bfb2f92.git.el9_0.2 | RHSA-2024:4411 |
| RHEL 8.8 EUS | booth +4 | 1.0-283.1.9d4029a.git.el8_8.1 | RHSA-2024:3658 |
| RHEL 8.6 TUS | booth +4 | 1.0-199.1.ac1d34c.git.el8_6.2 | RHSA-2024:4400 |
| RHEL 8.6 E4S | booth +4 | 1.0-199.1.ac1d34c.git.el8_6.2 | RHSA-2024:4400 |
| RHEL 8.4 TUS | booth +4 | 1.0-199.1.ac1d34c.git.el8_4.2 | RHSA-2024:3657 |
| RHEL 8.4 E4S | booth +4 | 1.0-199.1.ac1d34c.git.el8_4.2 | RHSA-2024:3657 |
| RHEL 8.4 AUS | booth +4 | 1.0-199.1.ac1d34c.git.el8_4.2 | RHSA-2024:3657 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | booth +4 | 1.1-1.el9_4.1 | ALSA-2024:3661 |
| AlmaLinux 8 | booth +4 | 1.1-1.el8_10.1 | ALSA-2024:3659 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | booth | 1.1-1.el9_4.1 | RLSA-2024:3661 |
| Rocky Linux 8 | booth | 1.1-1.el8_10.1 | RLSA-2024:3659 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | booth | 1.1+git0.09b0074-150600.3.3.1 | SUSE-SU-2024:2040-1 |
| SLES 15 SP5 | booth | 1.0+20220815.f40c2d5-150500.3.3.1 | SUSE-SU-2024:2063-1 |
| SLES 15 SP4 | booth | 1.0+20210519.bfb2f92-150400.3.6.1 | SUSE-SU-2024:2042-1 |
| SLES 15 SP3 | booth | 1.0-150300.18.6.1 | SUSE-SU-2024:2062-1 |
| SLES 15 SP2 | booth | 1.0-150100.11.6.1 | SUSE-SU-2024:2041-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | booth | 1.0-42.6.1 | SUSE-SU-2024:2251-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | booth | 1.2+git0.322fea0-1.1 | openSUSE-SU-2024:14045-1 |
| openSUSE Leap 15.6 | booth | 1.1+git0.09b0074-150600.3.3.1 | SUSE-SU-2024:2040-1 |
| openSUSE Leap 15.5 | booth | 1.0+20220815.f40c2d5-150500.3.3.1 | SUSE-SU-2024:2063-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | booth +4 | 1.0-8.ef769ef.git.amzn2.0.2 | ALAS2-2024-2575 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | booth | 1.2-1 | — |
| Azure Linux 2 (CBL-Mariner) | booth | No fix yet | — |
Advisories 23
- ALSA-2024:3661 Important: booth security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3659 Important: booth security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8832-1 booth vulnerability Ubuntu Security Notices (USN) · Sep 28, 2026
- WID-SEC-2024-1302 Red Hat Enterprise Linux (Booth): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 28, 2026
- RHSA-2024:4411 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:4400 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:3661 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:3659 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:3660 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:3658 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:3657 Red Hat Security Advisory: booth security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-5777-1 booth - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3894-1 booth - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:3659 Important: booth security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:3661 Important: booth security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:2040-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2042-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2041-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2063-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2062-1 Security update for booth SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14045-1 booth-1.2+git0.322fea0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2024:2251-1 Security update for booth SUSE / openSUSE Security Updates · May 2, 2025
- ALAS2-2024-2575 Important: booth security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 24, 2024
References
- RHSA-2024:3657 vendor-advisory
- RHSA-2024:3658 vendor-advisory
- RHSA-2024:3659 vendor-advisory
- RHSA-2024:3660 vendor-advisory
- RHSA-2024:3661 vendor-advisory
- RHSA-2024:4400 vendor-advisory
- RHSA-2024:4411 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-3049 vdb-entry
- RHBZ#2272082 issue-tracking
- https://github.com/ClusterLabs/booth/pull/142