CVE-2024-3049: Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-06 · updated 2026-06-17
Weakness: CWE-345

Description

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

Affected products

ClusterLabs Booth: before 1.1 — fixed in 1.1
Red Hat Enterprise Linux: 7.0, 8.0, 9.0
RedHat Enterprise Linux Eus: 8.4, 8.8, 9.2
RedHat Enterprise Linux For Arm 64: 8.0_aarch64, 8.8_aarch64, 9.2_aarch64, 9.4_aarch64
RedHat Enterprise Linux For Ibm Z Systems: 8.0_s390x, 9.2_s390x, 9.4_s390x
RedHat Enterprise Linux For Ibm Z Systems Eus: 8.8_s390x
RedHat Enterprise Linux For Power Little Endian Eus: 8.0_ppc64le, 8.4_ppc64le, 8.8_ppc64le, 9.2_ppc64le, 9.4_ppc64le
RedHat Enterprise Linux Server Update Services For Sap Solutions: 8.4

How to fix

Upgrade to a fixed version: ClusterLabs Booth 1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3049 or the next vulnerability affects your stack