CVE-2024-2746

Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happened before Polkit authentication was even started. The dnf5 library code does not check whether non-root users control the directory in question.  On one hand, this poses a Denial-of-Service attack vector by making the daemonoperate on a blocking file (e.g. named FIFO special file) or a very large file that causes an out-of-memory situation (e.g. /dev/zero). On the other hand, this can be used to let the daemon process privileged files like /etc/shadow. The file in question is parsed as an INI file. Error diagnostics resulting from parsing privileged files could cause information leaks, if these diagnostics are accessible to unprivileged users. In the case of libdnf5, no such user accessible diagnostics should exist, though. Also, a local attacker can place a valid repository configuration file in this directory. This configuration file allows to specify a plethora of additional configuration options. This makes various additional code paths in libdnf5 accessible to the attacker.

• CWE-20

• https://www.openwall.com/lists/oss-security/2024/04/03/5
• https://www.openwall.com/lists/oss-security/2024/04/03/5

Published

May 8, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27454orjson.loads in orjson before 3.9.15 does not limit recursio…7.5
• CVE-2024-27455In the Bentley ALIM Web application, certain configuration s…9.1
• CVE-2024-27456rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissi…9.1
• CVE-2024-27457Improper check for unusual or exceptional conditions in Inte…2.5
• CVE-2024-27458A potential security vulnerability has been identified in th…8.8
• CVE-2024-27459The interactive service in OpenVPN 2.6.9 and earlier allows …7.8
• CVE-2024-27460A privilege escalation exists in the updater for Plantronics…6.7
• CVE-2024-27461Incorrect default permissions in software installer for Inte…5.5
• CVE-2024-27462Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-2747CWE-428: Unquoted search path or element vulnerability exist…7.8
• CVE-2024-27474Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (…8.8
• CVE-2024-27476Leantime 3.0.6 is vulnerable to HTML Injection via /dashboar…4.7