Every CVE Search/ Get API key

CVE-2022-2553

The authfile directive in the booth config file is ignored, preventing use of authentication in...

6.5 MediumFix available

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.31%Up 0.4 points since Jul 29, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
CVE-2022-2553
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
CVE-2022-2553
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2022-34807 No score

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
EUVD-2022-34807
Updated
2026-11-03
GitHub AdvisoriesGHSA-9ppf-2r5r-2chh 6.5

The authfile directive in the booth config file is ignored, preventing use of authentication in...

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
GHSA-9ppf-2r5r-2chh
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
OSVAZL-25645 6.5

CVE-2022-2553 affecting package booth for versions less than 1.0-8

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
AZL-25645
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-36933 6.5

CVE-2022-2553 affecting package booth for versions less than 1.0-8

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
AZL-36933
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2022-2553 6.5

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
DEBIAN-CVE-2022-2553
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
OSVRHSA-2022:6250 6.5

Red Hat Security Advisory: booth security update

Record
RHSA-2022:6250
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2022:6439 6.5

Red Hat Security Advisory: booth security update

Record
RHSA-2022:6439
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2022:6580 6.5

Red Hat Security Advisory: booth security update

Record
RHSA-2022:6580
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2022:6439 6.5

Moderate: booth security update

The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one (granted) site at a time.

Security Fix(es):

  • booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:6439
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2022-2553 6.5

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
UBUNTU-CVE-2022-2553
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2022:6439 No score

Moderate: booth security update

The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one (granted) site at a time.

Security Fix(es):

  • booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:6439
Updated
2026-11-02
OSVALSA-2022:6580 No score

Moderate: booth security update

The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one (granted) site at a time.

Security Fix(es):

  • booth: authfile directive in booth config file is completely ignored. (CVE-2022-2553)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:6580
Updated
2026-11-02
OSV No score

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

Record
CVE-2022-2553
Weakness
CWE-287
Updated
2026-11-02
OSVopenSUSE-SU-2024:12315-1 No score

booth-1.0+20220724.dce51f9-1.1 on GA media

These are all security issues fixed in the booth-1.0+20220724.dce51f9-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12315-1
Updated
2026-11-02
OSVSUSE-SU-2022:2605-1 No score

Security update for booth

This update for booth fixes the following issues:

  • CVE-2022-2553: authfile directive in booth config file is completely ignored (bsc#1201946).
Record
SUSE-SU-2022:2605-1
Updated
2026-11-02
OSVSUSE-SU-2022:2606-1 No score

Security update for booth

This update for booth fixes the following issues:

  • CVE-2022-2553: authfile directive in booth config file is completely ignored (bsc#1201946).
Record
SUSE-SU-2022:2606-1
Updated
2026-11-02
OSVSUSE-SU-2022:2607-1 No score

Security update for booth

This update for booth fixes the following issues:

  • CVE-2022-2553: authfile directive in booth config file is completely ignored (bsc#1201946).
Record
SUSE-SU-2022:2607-1
Updated
2026-11-02
OSVSUSE-SU-2022:2608-1 No score

Security update for booth

This update for booth fixes the following issues:

  • CVE-2022-2553: authfile directive in booth config file is completely ignored (bsc#1201946).
Record
SUSE-SU-2022:2608-1
Updated
2026-11-02
OSVSUSE-SU-2022:2609-1 No score

Security update for booth

This update for booth fixes the following issues:

  • CVE-2022-2553: authfile directive in booth config file is completely ignored (bsc#1201946).
Record
SUSE-SU-2022:2609-1
Updated
2026-11-02
OSVUSN-5556-1 No score

booth vulnerability

It was discovered that Booth incorrectly handled user authentication. An attacker could use this vulnerability to cause a denial of service.

Record
USN-5556-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
booth
AlmaLinux:8
 before 1.0-199.1.ac1d34c.git.el8_6.1
1.0-199.1.ac1d34c.git.el8_6.1
booth-arbitrator
AlmaLinux:8
 before 1.0-199.1.ac1d34c.git.el8_6.1
1.0-199.1.ac1d34c.git.el8_6.1
booth-core
AlmaLinux:8
 before 1.0-199.1.ac1d34c.git.el8_6.1
1.0-199.1.ac1d34c.git.el8_6.1
booth-site
AlmaLinux:8
 before 1.0-199.1.ac1d34c.git.el8_6.1
1.0-199.1.ac1d34c.git.el8_6.1
booth-test
AlmaLinux:8
 before 1.0-199.1.ac1d34c.git.el8_6.1
1.0-199.1.ac1d34c.git.el8_6.1
booth
AlmaLinux:9
 before 1.0-251.3.bfb2f92.git.el9_0.1
1.0-251.3.bfb2f92.git.el9_0.1
booth-arbitrator
AlmaLinux:9
 before 1.0-251.3.bfb2f92.git.el9_0.1
1.0-251.3.bfb2f92.git.el9_0.1
booth-core
AlmaLinux:9
 before 1.0-251.3.bfb2f92.git.el9_0.1
1.0-251.3.bfb2f92.git.el9_0.1
booth-site
AlmaLinux:9
 before 1.0-251.3.bfb2f92.git.el9_0.1
1.0-251.3.bfb2f92.git.el9_0.1
booth-test
AlmaLinux:9
 before 1.0-251.3.bfb2f92.git.el9_0.1
1.0-251.3.bfb2f92.git.el9_0.1
Show 63 moreShow less
Affected packages
PackageAffectedFixed
booth
Azure Linux:2
 before 1.0-8
1.0-8
booth
Azure Linux:3
 before 1.0-8
1.0-8
booth
Debian:12
 before 1.0-268-gdce51f9-1
1.0-268-gdce51f9-1
booth
Debian:13
 before 1.0-268-gdce51f9-1
1.0-268-gdce51f9-1
booth
Debian:14
 before 1.0-268-gdce51f9-1
1.0-268-gdce51f9-1
booth
Debian:10
 before 1.0-162-g27f917f-2+deb10u1, plus listed versions
1.0-162-g27f917f-2
1.0-162-g27f917f-2+deb10u1
booth
Debian:11
 before 1.0-237-gdd88847-2+deb11u1, plus listed versions
1.0-237-gdd88847-2
1.0-237-gdd88847-2+deb11u1
booth
Red Hat:rhel_eus:8.4::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-arbitrator
Red Hat:rhel_eus:8.4::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-core
Red Hat:rhel_eus:8.4::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-core-debuginfo
Red Hat:rhel_eus:8.4::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-debugsource
Red Hat:rhel_eus:8.4::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-site
Red Hat:rhel_eus:8.4::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-test
Red Hat:rhel_eus:8.4::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-arbitrator
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-core
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-core-debuginfo
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-debugsource
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-site
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth-test
Red Hat:rhel_eus:8.4::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_4.1
0:1.0-199.1.ac1d34c.git.el8_4.1
booth
Red Hat:enterprise_linux:8::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-arbitrator
Red Hat:enterprise_linux:8::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-core
Red Hat:enterprise_linux:8::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-core-debuginfo
Red Hat:enterprise_linux:8::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-debugsource
Red Hat:enterprise_linux:8::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-site
Red Hat:enterprise_linux:8::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-test
Red Hat:enterprise_linux:8::highavailability
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth
Red Hat:enterprise_linux:8::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-arbitrator
Red Hat:enterprise_linux:8::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-core
Red Hat:enterprise_linux:8::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-core-debuginfo
Red Hat:enterprise_linux:8::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-debugsource
Red Hat:enterprise_linux:8::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-site
Red Hat:enterprise_linux:8::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth-test
Red Hat:enterprise_linux:8::resilientstorage
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth
Red Hat:enterprise_linux:9::highavailability
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-arbitrator
Red Hat:enterprise_linux:9::highavailability
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-core
Red Hat:enterprise_linux:9::highavailability
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-core-debuginfo
Red Hat:enterprise_linux:9::highavailability
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-debugsource
Red Hat:enterprise_linux:9::highavailability
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-site
Red Hat:enterprise_linux:9::highavailability
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-test
Red Hat:enterprise_linux:9::highavailability
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth
Red Hat:enterprise_linux:9::resilientstorage
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-arbitrator
Red Hat:enterprise_linux:9::resilientstorage
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-core
Red Hat:enterprise_linux:9::resilientstorage
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-core-debuginfo
Red Hat:enterprise_linux:9::resilientstorage
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-debugsource
Red Hat:enterprise_linux:9::resilientstorage
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-site
Red Hat:enterprise_linux:9::resilientstorage
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth-test
Red Hat:enterprise_linux:9::resilientstorage
 before 0:1.0-251.3.bfb2f92.git.el9_0.1
0:1.0-251.3.bfb2f92.git.el9_0.1
booth
Rocky Linux:8
 before 0:1.0-199.1.ac1d34c.git.el8_6.1
0:1.0-199.1.ac1d34c.git.el8_6.1
booth
SUSE:Linux Enterprise High Availability GEO Extension 12 SP4
 before 1.0-42.3.1
1.0-42.3.1
booth
SUSE:Linux Enterprise High Availability GEO Extension 12 SP5
 before 1.0-42.3.1
1.0-42.3.1
booth
SUSE:Linux Enterprise High Availability Extension 15 SP1
 before 1.0-150100.11.3.1
1.0-150100.11.3.1
booth
SUSE:Linux Enterprise High Availability Extension 15 SP2
 before 1.0-150100.11.3.1
1.0-150100.11.3.1
booth
SUSE:Linux Enterprise High Availability Extension 15
 before 1.0-150000.6.3.1
1.0-150000.6.3.1
booth
SUSE:Linux Enterprise High Availability Extension 15 SP3
 before 1.0-150300.18.3.1
1.0-150300.18.3.1
booth
openSUSE:Leap 15.3
 before 1.0-150300.18.3.1
1.0-150300.18.3.1
booth
SUSE:Linux Enterprise High Availability Extension 15 SP4
 before 1.0+20210519.bfb2f92-150400.3.3.1
1.0+20210519.bfb2f92-150400.3.3.1
booth
openSUSE:Leap 15.4
 before 1.0+20210519.bfb2f92-150400.3.3.1
1.0+20210519.bfb2f92-150400.3.3.1
booth
Ubuntu:20.04:LTS
 before 1.0-174-gce9f821-1ubuntu0.2, plus listed versions
1.0-162-g27f917f-21.0-174-gce9f821-1
1.0-174-gce9f821-1ubuntu0.2
booth
Ubuntu:22.04:LTS
 before 1.0-237-gdd88847-4ubuntu2.2, plus listed versions
1.0-237-gdd88847-21.0-237-gdd88847-4ubuntu11.0-237-gdd88847-4ubuntu2
1.0-237-gdd88847-4ubuntu2.2
booth
Ubuntu:25.10
 All versions, plus listed versions
1.2-2ubuntu11.2-2ubuntu21.2-3ubuntu1
 None known
booth
openSUSE:Tumbleweed
 before 1.0+20220724.dce51f9-1.1
1.0+20220724.dce51f9-1.1

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2553 is a medium vulnerability (CVSS 6.5) in Clusterlabs Booth, published July 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in booth 1.0-199.1.ac1d34c.git.el8_6.1.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open