AZL-66105
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-66105.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-66105
- Upstream
- Published
- 2024-05-08T02:15:09Z
- Modified
- 2026-04-21T04:37:46.704411Z
- Summary
- CVE-2024-1930 affecting package dnf5 for versions less than 5.0.14-3
- Details
-
No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions.
There is no limit on how many sessions D-Bus clients may create using the
open_session()D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service. - References