Skip to content
Fencer Vulns
medium 5.9

CVE-2024-3049 json

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

published 2024-06-06 2 y ago modified 2026-11-04 4 d ago also EUVD-2024-31656

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 0:1.1-1.el8_10.1
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.0-199.1.ac1d34c.git.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 0:1.0-199.1.ac1d34c.git.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 0:1.0-199.1.ac1d34c.git.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.0-199.1.ac1d34c.git.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.0-199.1.ac1d34c.git.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 0:1.0-283.1.9d4029a.git.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 0:1.1-1.el9_4.1
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.0-251.3.bfb2f92.git.el9_0.2
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:1.0-283.1.9d4029a.git.el9_2.1
  • booth Debian 12 1.0-283-g9d4029a-2+deb12u1
  • booth Debian 14, Debian 13 1.1-2

debian advisories DEBIAN-CVE-2024-3049

  • booth Ubuntu Pro 18.04 LTS 1.0-6ubuntu1+esm1
  • booth Ubuntu Pro 20.04 LTS 1.0-174-gce9f821-1ubuntu0.2+esm1
  • booth Ubuntu Pro 22.04 LTS 1.0-237-gdd88847-4ubuntu2.2+esm1
  • booth Ubuntu Pro 24.04 LTS 1.1-1ubuntu4+esm1

ubuntu advisories UBUNTU-CVE-2024-3049

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • booth RHEL 9 1.1-1.el9_4.1
  • booth-core RHEL 9 1.1-1.el9_4.1
  • booth-site RHEL 9 1.1-1.el9_4.1
  • booth-test RHEL 9 1.1-1.el9_4.1
  • booth-arbitrator RHEL 9 1.1-1.el9_4.1
  • booth RHEL 8 1.1-1.el8_10.1
  • booth-core RHEL 8 1.1-1.el8_10.1
  • booth-site RHEL 8 1.1-1.el8_10.1

red hat advisories RHSA-2024:3661RHSA-2024:3660RHSA-2024:4411RHSA-2024:3659RHSA-2024:4400RHSA-2024:3658

  • booth SLE High Availability GEO Extension 12 SP5 1.0-42.6.1
  • booth SLE High Availability Extension 15 SP5, openSUSE Leap 15.5 1.0+20220815.f40c2d5-150500.3.3.1
  • booth SLE High Availability Extension 15 SP3 1.0-150300.18.6.1
  • booth SLE High Availability Extension 15 SP4 1.0+20210519.bfb2f92-150400.3.6.1
  • booth SLE High Availability Extension 15 SP2 1.0-150100.11.6.1
  • booth SLE High Availability Extension 15 SP6, openSUSE Leap 15.6 1.1+git0.09b0074-150600.3.3.1

suse advisories SUSE-SU-2024:2251-1SUSE-SU-2024:2063-1SUSE-SU-2024:2062-1SUSE-SU-2024:2042-1SUSE-SU-2024:2041-1SUSE-SU-2024:2040-1

  • booth openSUSE Tumbleweed 1.2+git0.322fea0-1.1

opensuse advisories openSUSE-SU-2024:14045-1

  • booth AlmaLinux 8 1.1-1.el8_10.1
  • booth-core AlmaLinux 8 1.1-1.el8_10.1
  • booth-site AlmaLinux 8 1.1-1.el8_10.1
  • booth-test AlmaLinux 8 1.1-1.el8_10.1
  • booth-arbitrator AlmaLinux 8 1.1-1.el8_10.1
  • booth AlmaLinux 9 1.1-1.el9_4.1
  • booth-core AlmaLinux 9 1.1-1.el9_4.1
  • booth-site AlmaLinux 9 1.1-1.el9_4.1

almalinux advisories ALSA-2024:3659ALSA-2024:3661

  • booth Rocky Linux 9 1.1-1.el9_4.1
  • booth Rocky Linux 8 1.1-1.el8_10.1

rocky linux advisories RLSA-2024:3661RLSA-2024:3659

  • booth Azure Linux 3.0 1.2-1

azure linux advisories AZL-42540

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-3049 updated cvss 5.9

booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server

  • Red Hat Enterprise Linux 7 booth, booth-core, booth-site, booth-test, booth-arbitrator
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 10 booth
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux High Availability AUS (v.8.4) booth 1.0-199.1.ac1d34c.git.el8_4.2, booth-core 1.0-199.1.ac1d34c.git.el8_4.2, booth-site 1.0-199.1.ac1d34c.git.el8_4.2, booth-test 1.0-199.1.ac1d34c.git.el8_4.2, booth-arbitrator 1.0-199.1.ac1d34c.git.el8_4.2
    fixed: vendor fix RHSA-2024:3657
  • Red Hat Enterprise Linux High Availability E4S (v.8.6) booth 1.0-199.1.ac1d34c.git.el8_6.2, booth-core 1.0-199.1.ac1d34c.git.el8_6.2, booth-site 1.0-199.1.ac1d34c.git.el8_6.2, booth-test 1.0-199.1.ac1d34c.git.el8_6.2, booth-arbitrator 1.0-199.1.ac1d34c.git.el8_6.2
    fixed: vendor fix RHSA-2024:4400
  • Red Hat Enterprise Linux High Availability E4S (v.9.0) booth 1.0-251.3.bfb2f92.git.el9_0.2, booth-core 1.0-251.3.bfb2f92.git.el9_0.2, booth-site 1.0-251.3.bfb2f92.git.el9_0.2, booth-test 1.0-251.3.bfb2f92.git.el9_0.2, booth-arbitrator 1.0-251.3.bfb2f92.git.el9_0.2
    fixed: vendor fix RHSA-2024:4411
  • Red Hat Enterprise Linux High Availability EUS (v.8.8) booth 1.0-283.1.9d4029a.git.el8_8.1, booth-core 1.0-283.1.9d4029a.git.el8_8.1, booth-site 1.0-283.1.9d4029a.git.el8_8.1, booth-test 1.0-283.1.9d4029a.git.el8_8.1, booth-arbitrator 1.0-283.1.9d4029a.git.el8_8.1
    fixed: vendor fix RHSA-2024:3658
  • Red Hat Enterprise Linux High Availability EUS (v.9.2) booth 1.0-283.1.9d4029a.git.el9_2.1, booth-core 1.0-283.1.9d4029a.git.el9_2.1, booth-site 1.0-283.1.9d4029a.git.el9_2.1, booth-test 1.0-283.1.9d4029a.git.el9_2.1, booth-arbitrator 1.0-283.1.9d4029a.git.el9_2.1
    fixed: vendor fix RHSA-2024:3660
  • Red Hat Enterprise Linux High Availability TUS (v.8.6) booth 1.0-199.1.ac1d34c.git.el8_6.2, booth-core 1.0-199.1.ac1d34c.git.el8_6.2, booth-site 1.0-199.1.ac1d34c.git.el8_6.2, booth-test 1.0-199.1.ac1d34c.git.el8_6.2, booth-arbitrator 1.0-199.1.ac1d34c.git.el8_6.2
    fixed: vendor fix RHSA-2024:4400
show 8 more
  • Red Hat Enterprise Linux HighAvailability (v. 8) booth 1.1-1.el8_10.1, booth-core 1.1-1.el8_10.1, booth-site 1.1-1.el8_10.1, booth-test 1.1-1.el8_10.1, booth-arbitrator 1.1-1.el8_10.1
    fixed: vendor fix RHSA-2024:3659
  • Red Hat Enterprise Linux HighAvailability (v. 9) booth 1.1-1.el9_4.1, booth-core 1.1-1.el9_4.1, booth-site 1.1-1.el9_4.1, booth-test 1.1-1.el9_4.1, booth-arbitrator 1.1-1.el9_4.1
    fixed: vendor fix RHSA-2024:3661
  • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) booth 1.0-199.1.ac1d34c.git.el8_4.2, booth-core 1.0-199.1.ac1d34c.git.el8_4.2, booth-site 1.0-199.1.ac1d34c.git.el8_4.2, booth-test 1.0-199.1.ac1d34c.git.el8_4.2, booth-arbitrator 1.0-199.1.ac1d34c.git.el8_4.2 Red Hat Enterprise Linux HighAvailability TUS (v.8.4) booth 1.0-199.1.ac1d34c.git.el8_4.2, booth-core 1.0-199.1.ac1d34c.git.el8_4.2, booth-site 1.0-199.1.ac1d34c.git.el8_4.2, booth-test 1.0-199.1.ac1d34c.git.el8_4.2, booth-arbitrator 1.0-199.1.ac1d34c.git.el8_4.2
    fixed: vendor fix RHSA-2024:3657
  • Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) booth 1.0-283.1.9d4029a.git.el8_8.1, booth-core 1.0-283.1.9d4029a.git.el8_8.1, booth-site 1.0-283.1.9d4029a.git.el8_8.1, booth-test 1.0-283.1.9d4029a.git.el8_8.1, booth-arbitrator 1.0-283.1.9d4029a.git.el8_8.1
    fixed: vendor fix RHSA-2024:3658
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) booth 1.0-283.1.9d4029a.git.el9_2.1, booth-core 1.0-283.1.9d4029a.git.el9_2.1, booth-site 1.0-283.1.9d4029a.git.el9_2.1, booth-test 1.0-283.1.9d4029a.git.el9_2.1, booth-arbitrator 1.0-283.1.9d4029a.git.el9_2.1
    fixed: vendor fix RHSA-2024:3660
  • Red Hat Enterprise Linux ResilientStorage (v. 8) booth 1.1-1.el8_10.1, booth-core 1.1-1.el8_10.1, booth-site 1.1-1.el8_10.1, booth-test 1.1-1.el8_10.1, booth-arbitrator 1.1-1.el8_10.1
    fixed: vendor fix RHSA-2024:3659
  • Red Hat Enterprise Linux ResilientStorage (v. 9) booth 1.1-1.el9_4.1, booth-core 1.1-1.el9_4.1, booth-site 1.1-1.el9_4.1, booth-test 1.1-1.el9_4.1, booth-arbitrator 1.1-1.el9_4.1
    fixed: vendor fix RHSA-2024:3661
  • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) booth 1.0-251.3.bfb2f92.git.el9_0.2, booth-core 1.0-251.3.bfb2f92.git.el9_0.2, booth-site 1.0-251.3.bfb2f92.git.el9_0.2, booth-test 1.0-251.3.bfb2f92.git.el9_0.2, booth-arbitrator 1.0-251.3.bfb2f92.git.el9_0.2
    fixed: vendor fix RHSA-2024:4411

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.