The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the booth-1.0-251.4.bfb2f92.git.el9 build changelog.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of booth installed on the remote host is prior to 1.0-8.ef769ef.git. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2009 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6580 advisory.

    The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple     sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates     as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated     by a Booth formation are the units of authorization that can be bound to certain resources. This will     ensure that the resources are run at only one (granted) site at a time.

    Security Fix(es):

    * booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6744980220 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e0a87993b8 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6439 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:6580 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:6439 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6439 advisory.

    The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple     sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates     as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated     by a Booth formation are the units of authorization that can be bound to certain resources. This will     ensure that the resources are run at only one (granted) site at a time.

    Security Fix(es):

    * booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6250 advisory.

  - booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5556-1 advisory.

    It was discovered that Booth incorrectly handled user authentication. An attacker could use this     vulnerability to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2022:2605-1 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2608-1 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2609-1 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2606-1 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2607-1 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5194 advisory.

  - The authfile directive in the booth config file is ignored, preventing use of authentication in     communications from node to node. As a result, nodes that do not have the correct authentication key are     not prevented from communicating with other nodes in the cluster. (CVE-2022-2553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191273	CentOS 9 : booth-1.0-251.4.bfb2f92.git.el9	Nessus	CentOS Local Security Checks	medium
173908	Amazon Linux 2 : booth (ALAS-2023-2009)	Nessus	Amazon Linux Local Security Checks	medium
169721	RHEL 9 : booth (RHSA-2022:6580)	Nessus	Red Hat Local Security Checks	medium
169185	Fedora 36 : booth (2022-6744980220)	Nessus	Fedora Local Security Checks	medium
169114	Fedora 35 : booth (2022-e0a87993b8)	Nessus	Fedora Local Security Checks	medium
167804	Rocky Linux 8 : booth (RLSA-2022:6439)	Nessus	Rocky Linux Local Security Checks	medium
167653	AlmaLinux 9 : booth (ALSA-2022:6580)	Nessus	Alma Linux Local Security Checks	medium
166065	AlmaLinux 8 : booth (ALSA-2022:6439)	Nessus	Alma Linux Local Security Checks	medium
164962	RHEL 8 : booth (RHSA-2022:6439)	Nessus	Red Hat Local Security Checks	medium
164516	RHEL 8 : booth (RHSA-2022:6250)	Nessus	Red Hat Local Security Checks	medium
164003	Ubuntu 20.04 LTS / 22.04 LTS : Booth vulnerability (USN-5556-1)	Nessus	Ubuntu Local Security Checks	medium
163716	SUSE SLES12 Security Update : booth (SUSE-SU-2022:2605-1)	Nessus	SuSE Local Security Checks	medium
163690	SUSE SLES15 Security Update : booth (SUSE-SU-2022:2608-1)	Nessus	SuSE Local Security Checks	medium
163687	SUSE SLES15 Security Update : booth (SUSE-SU-2022:2609-1)	Nessus	SuSE Local Security Checks	medium
163685	SUSE SLES15 Security Update : booth (SUSE-SU-2022:2606-1)	Nessus	SuSE Local Security Checks	medium
163683	SUSE SLES15 Security Update : booth (SUSE-SU-2022:2607-1)	Nessus	SuSE Local Security Checks	medium
163656	Debian DSA-5194-1 : booth - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2022-2553

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium