2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"dnf5daemon-server","vendor":"Fedora","versions":[{"status":"affected","version":"5.1.16<="}]}],"source":"patrick@puiterwijk.org"},{"affectedData":[{"cpes":["cpe:2.3:a:fedora:dnf5daemon-server:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"dnf5daemon-server","vendor":"fedora","versions":[{"lessThan":"5.1.17","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:rpm-software-management:dnf5:*:*:*:*:*:*:*:*","matchCriteriaId":"011EF61C-CD6B-48B4-8E4B-EC5E3C9841AB","versionEndExcluding":"5.1.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions.\n\nThere is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service.\n\n"},{"lang":"es","value":"Sin límite en el número de sesiones abiertas / mal comportamiento de cierre de sesión en dnf5daemon-server anterior a 5.1.17 permite que un usuario malintencionado afecte la disponibilidad mediante Sin límite en el número de sesiones abiertas. No hay límite en la cantidad de sesiones que los clientes D-Bus pueden crear usando el método D-Bus `open_session()`. Para cada sesión se crea un hilo en dnf5daemon-server. Esto gasta un par de cientos de megabytes de memoria en el proceso. Será imposible realizar más conexiones, probablemente porque el servicio D-Bus no puede generar más subprocesos."}],"id":"CVE-2024-1930","lastModified":"2026-06-17T07:05:26.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":4.0,"source":"patrick@puiterwijk.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-1930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-05-08T14:47:09.395902Z","version":"2.0.3"}}]},"published":"2024-05-08T02:15:09.503","references":[{"source":"patrick@puiterwijk.org","tags":["Exploit","Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2024/03/04/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2024/03/04/2"}],"sourceIdentifier":"patrick@puiterwijk.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"patrick@puiterwijk.org","type":"Secondary"}]}
|