SUSE update for booth

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65903

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-2553

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to bypass certain security restrictions.

The vulnerability exists due to application does not properly restrict intra-node communication when configuring the authfile configuration directive. A remote node with incorrect authentication key can continue communication with the other node members.

Mitigation

Update the affected package booth to the latest version.

Vulnerable software versions

SUSE Linux Enterprise High Availability GEO: 12-SP4 - 12-SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise High Performance Computing: 12

SUSE Linux Enterprise Server: 11-SP3-CLIENT-TOOLS-BETA

booth-debugsource: before 1.0-42.3.1

booth-debuginfo: before 1.0-42.3.1

booth: before 1.0-42.3.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_high_availability_geo:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_availability_geo:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:11-SP3-CLIENT-TOOLS-BETA:*:*:*:*:*:*:*
• cpe:2.3:a:suse:booth-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:booth-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:booth:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20222605-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.