CVE-2024-3049

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

State: Published
Severity: 5.9 Medium
Published: Jun 6, 2024
Updated: Mar 17, 2026
Reserved: Mar 28, 2024

Description

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	redhat

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
booth	1.0-283.1Affected
Red Hat Enterprise Linux 8Red Hat	0:1.1-1.el8_10.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:1.0-199.1.ac1d34c.git.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceRed Hat	0:1.0-199.1.ac1d34c.git.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsRed Hat	0:1.0-199.1.ac1d34c.git.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	0:1.0-199.1.ac1d34c.git.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	0:1.0-199.1.ac1d34c.git.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat	0:1.0-283.1.9d4029a.git.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.1-1.el9_4.1 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat	0:1.0-251.3.bfb2f92.git.el9_0.2 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat	0:1.0-283.1.9d4029a.git.el9_2.1 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 7Red Hat

References

RHSA-2024:3657vendor-advisory
RHSA-2024:3658vendor-advisory
RHSA-2024:3659vendor-advisory
RHSA-2024:3660vendor-advisory
RHSA-2024:3661vendor-advisory
RHSA-2024:4400vendor-advisory
RHSA-2024:4411vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-3049vdb-entry
RHBZ#2272082issue-tracking
https://github.com/ClusterLabs/booth/pull/142
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERCFM3HXFJKLEMMWU3CZLPKH5LZAEDAN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPK5BHYOB7CFFRQAN55YV5LH44PWHMQD/
https://lists.debian.org/debian-lts-announce/2024/09/msg00037.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.