Denial of Service Vulnerability in Clojure Package
Summary
CVE-2024-22871: An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function. Affects clojure versions >= 0436abdb51ae6d53517b74bf84a33162397744b0, < 218054f1f2ddfc69ef4f9d17f916de35e4a4effe. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Clojure is a dynamic, functional programming language that runs on the Java Virtual Machine (JVM). It is designed for concurrency and provides a rich set of features for building robust applications. The language is widely used for web development, data analysis, and other applications requiring high performance and scalability. However, certain versions of Clojure (1.20 to 1.12.0-alpha5) are vulnerable to a denial of service (DoS) attack, which can disrupt the normal functioning of applications built with this package.
Vulnerability Detail
The vulnerability identified as CVE-2024-22871 arises from an issue in the clojure.core$partial$fn__5920 function. This flaw allows an attacker to exploit the function, potentially leading to a denial of service condition. The attack can cause the application to become unresponsive, impacting users and services relying on the affected Clojure version. The vulnerability affects multiple Debian ecosystems, including versions 11, 12, and 13, with specific ranges of affected versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing rate limiting or input validation to mitigate the risk of a denial of service attack. Additionally, monitor your application for unusual traffic patterns that may indicate an ongoing attack.
Conclusion
The CVE-2024-22871 vulnerability poses a significant risk to applications using affected versions of Clojure, potentially leading to denial of service conditions. It is crucial for developers to upgrade to secure versions and consider workarounds if immediate upgrades are not feasible. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for clojure →
FAQ
CVE-2024-22871 is a vulnerability in Clojure that allows for denial of service attacks through the clojure.core$partial$fn__5920 function.
Clojure versions 1.20 to 1.12.0-alpha5 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Implement rate limiting and input validation as temporary measures to reduce the risk of a denial of service attack.
Detailed information can be found in the official CVE database and through security advisories related to Clojure.
References
Related vulnerabilities
Recent vulnerabilities recorded for clojure.
