Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Fedora 39: FEDORA-2024-17e71fc540 Critical HMAC Security Issue

fedora
Calendar Grey June 16, 2024
Scroller Fedora
Fedora 39 has released an update targeting CVE-2024-3049 for booth, significantly bolstering security by implementing essential corrections in HMAC management.
Security fix for CVE-2024-3049

Summary

Booth manages tickets which authorize cluster sites located

in geographically dispersed locations to run resources.

It facilitates support of geographically distributed

clustering in Pacemaker.

Update Information:

Security fix for CVE-2024-3049

Topics%20covered

Topics Covered

security advisory Fedora 39 booth critical HMAC fix ticket management

Change Log

* Fri Jun 7 2024 Jan Friesse - 1.0-283.5.9d4029a.git - attr: Fix reading of server_reply - auth: Check result of gcrypt gcry_md_get_algo_dlen (fixes CVE-2024-3049)

References


[ 1 ] Bug #2272082 - CVE-2024-3049 booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server https://bugzilla.redhat.com/show_bug.cgi?id=2272082

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-17e71fc540' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: booth
Product: Fedora 39
Version: 1.0
Release: 283.5.9d4029a.git.fc39
URL: https://github.com/ClusterLabs/booth
Summary: Ticket Manager for Multi-site Clusters

Topics%20covered

Topics Covered

security advisory Fedora 39 booth critical HMAC fix ticket management

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.