CVE-2024-22871 Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
An attacker can cause a denial of service in Clojure applications via the clojure.core$partial$fn__5920 function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22871?
CVE-2024-22871 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 29 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
Weakness: CWE-502
Which versions are affected by CVE-2024-22871?
4 open source packages ship an affected version, including org.clojure:clojure. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.clojure:clojure Maven | From 1.12.0-alpha1 | 1.12.0-alpha9 |
org.clojure:clojure Maven | From 1.12.0-alpha1 | 1.12.0-alpha9 |
org.clojure:clojure Maven | From 1.7.0 | 1.11.2 |
org.clojure:clojure Maven | From 1.7.0 | 1.11.2 |
Linux distribution packages (1)
clojure openSUSE:Tumbleweed | All versions | 1.11.2.1446-1.1 |
Products include Clojure Clojure, Fedoraproject Fedora.
How do I fix CVE-2024-22871?
Upgrade org.clojure:clojure to a fixed version for your release line: 1.12.0-alpha9 or 1.11.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-22871 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22871 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as CLEANSTART-2024-QB51386, DEBIAN-CVE-2024-22871, GHSA-vr64-r9qj-h27f, MGASA-2024-0093, ROOT-APP-MAVEN-CVE-2024-22871, UBUNTU-CVE-2024-22871 and 1 more.