CVE-2024-1930CWE-400

No Limit on Number of Open Sessions / Bad Session Close Behaviour

Medium · published May 8, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions.

There is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-05-08T01:52Z
EPSS history
Timeline
  • 08 MAY 01:52Z
    No Limit on Number of Open Sessions / Bad Session Close Behaviour
    cvelistv5