SUSE update for booth

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65903

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2553

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to bypass certain security restrictions.

The vulnerability exists due to application does not properly restrict intra-node communication when configuring the authfile configuration directive. A remote node with incorrect authentication key can continue communication with the other node members.

Mitigation

Update the affected package booth to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Storage: 6 - 7.1

SUSE Linux Enterprise High Availability: 15-SP1 - 15-SP2

SUSE Manager Proxy: 4.0 - 4.1

SUSE Manager Retail Branch Server: 4.0 - 4.1

SUSE Manager Server: 4.0 - 4.1

SUSE Linux Enterprise Server for SAP Applications: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1 - 15-SP2

SUSE Linux Enterprise High Performance Computing: 15-SP1 - 15-SP2

booth-debugsource: before 1.0-150100.11.3.1

booth-debuginfo: before 1.0-150100.11.3.1

booth: before 1.0-150100.11.3.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_storage:6:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_storage:7.1:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_availability:15-SP1:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_availability:15-SP2:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_manager_proxy:4.0:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.0:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_manager_server:4.0:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP2:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP1:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP2:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP2:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1:*:*:*:*:*:*:

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222606-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.