← Back

CVE-2024-3049

nvd nist
Published: Jun 6, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

Affected (21)

Clusterlabs
1 product
Booth
Redhat
7 products
Enterprise Linux
Enterprise Linux Eus
Enterprise Linux For Arm 64
Enterprise Linux For Ibm Z Systems
Enterprise Linux For Ibm Z Systems Eus
Enterprise Linux For Power Little Endian Eus
Enterprise Linux Server Update Services For Sap Solutions
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Booth
Before 1.1
Configuration B
20 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Enterprise Linux
Version 7.0
Enterprise Linux
Version 8.0
Enterprise Linux
Version 9.0
Redhat
Enterprise Linux Eus
Version 8.4
Enterprise Linux Eus
Version 8.8
Enterprise Linux Eus
Version 9.2
Redhat
Enterprise Linux For Arm 64
Version 8.0_aarch64
Enterprise Linux For Arm 64
Version 8.8_aarch64
Enterprise Linux For Arm 64
Version 9.2_aarch64
Enterprise Linux For Arm 64
Version 9.4_aarch64
Redhat
Enterprise Linux For Ibm Z Systems
Version 8.0_s390x
Enterprise Linux For Ibm Z Systems
Version 9.2_s390x
Enterprise Linux For Ibm Z Systems
Version 9.4_s390x
Enterprise Linux For Ibm Z Systems Eus
Version 8.8_s390x
Redhat
Enterprise Linux For Power Little Endian Eus
Version 8.0_ppc64le
Enterprise Linux For Power Little Endian Eus
Version 8.4_ppc64le
Enterprise Linux For Power Little Endian Eus
Version 8.8_ppc64le
Enterprise Linux For Power Little Endian Eus
Version 9.2_ppc64le
Enterprise Linux For Power Little Endian Eus
Version 9.4_ppc64le
Enterprise Linux Server Update Services For Sap Solutions
Version 8.4

Related CWEs

CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (22)

Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Issue Tracking
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.