Skip to content
fr Sign in
6.5 Medium

CVE-2024-1930 No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious…

Description

No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service.

Affected products and versions

Product Affected versions Fixed in
dnf5daemon-server Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of dnf5daemon-server

The 3 CVEs of dnf5daemon-server →
CVE-2024-2746 Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary… 8.8 High CVE-2024-1929 Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact… 7.5 High
Track this CVE