The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Booth | Clusterlabs | * | 1.0 (including) |
| Red Hat Enterprise Linux 8 | RedHat | booth-0:1.0-199.1.ac1d34c.git.el8_6.1 | * |
| Red Hat Enterprise Linux 8.4 Extended Update Support | RedHat | booth-0:1.0-199.1.ac1d34c.git.el8_4.1 | * |
| Red Hat Enterprise Linux 9 | RedHat | booth-0:1.0-251.3.bfb2f92.git.el9_0.1 | * |
| Booth | Ubuntu | bionic | * |
| Booth | Ubuntu | esm-apps/focal | * |
| Booth | Ubuntu | esm-apps/jammy | * |
| Booth | Ubuntu | focal | * |
| Booth | Ubuntu | jammy | * |
| Booth | Ubuntu | kinetic | * |
| Booth | Ubuntu | lunar | * |
| Booth | Ubuntu | mantic | * |
| Booth | Ubuntu | oracular | * |
| Booth | Ubuntu | plucky | * |
| Booth | Ubuntu | trusty | * |
| Booth | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- https://github.com/ClusterLabs/booth/commit/35bf0b7b048d715f671eb68974fb6b4af6528c67
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4T4TTXAABVUCMPUL7XQ2PH5EYYOOQZY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHDOFX7NQFH3UGZZA3SGW5SVMDDHIUVD/
- https://www.debian.org/security/2022/dsa-5194
- https://github.com/ClusterLabs/booth/commit/35bf0b7b048d715f671eb68974fb6b4af6528c67
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4T4TTXAABVUCMPUL7XQ2PH5EYYOOQZY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHDOFX7NQFH3UGZZA3SGW5SVMDDHIUVD/
- https://www.debian.org/security/2022/dsa-5194