Denial of Service Vulnerability in Clojure Package
Summary
DEBIAN-CVE-2024-22871: An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function. Affects clojure versions < 1.11.2-1. Fixed in 1.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Clojure is a dynamic programming language that targets the Java Virtual Machine (JVM). It is designed for functional programming and emphasizes immutability and concurrency. The package is widely used for building robust applications, but it has recently been identified to have a vulnerability that could lead to denial of service (DoS) attacks.
Vulnerability Detail
An issue has been discovered in Clojure versions 1.20 to 1.12.0-alpha5, specifically within the clojure.core$partial$fn__5920 function. This vulnerability allows an attacker to exploit the function, potentially leading to a denial of service (DoS). The vulnerability arises from improper handling of certain inputs, which can cause the application to become unresponsive or crash.
How To Fix
Minimum fixed version
1.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade clojureTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the clojure.core$partial$fn__5920 function in your code until the package is updated. Review your codebase for any instances where this function is utilized and consider alternative implementations.
Conclusion
The identified vulnerability in the Clojure package poses a significant risk of denial of service attacks. It is crucial for users to update to the patched version 1.11.2-1 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for clojure →
FAQ
The vulnerability can lead to a denial of service (DoS), causing the application to become unresponsive or crash.
Clojure versions 1.20 to 1.12.0-alpha5 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, the patched version of Clojure is 1.11.2-1. Updating to this version will resolve the vulnerability.
If you cannot update immediately, consider avoiding the use of the affected function as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for clojure.
