CVE-2024-22871 — Deserialization of Untrusted Data in Clojure

CWE-502 — Deserialization of Untrusted Data6 documents5 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 22.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ClojureFedoraproject Fedora
Timeline
PublishedFeb 29

Description

An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDclojure/clojure1.2.0 — 1.11.2+1
▶Debianclojure/clojure< 1.11.2-1+1

Also affects: Fedora 38, 39, 40

🔴Vulnerability Details

4
OSV
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service↗2024-02-29
▶
OSV
CVE-2024-22871: An issue in Clojure versions 1↗2024-02-29
▶
CVEList
CVE-2024-22871: An issue in Clojure versions 1↗2024-02-29
▶
GHSA
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service↗2024-02-29
▶

📋Vendor Advisories

1
Debian
CVE-2024-22871: clojure - An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a...↗2024
▶
CVE-2024-22871 — Deserialization of Untrusted Data | cvebase