Denial of Service Vulnerability in Clojure Package: CVE-2024-22871
Summary
UBUNTU-CVE-2024-22871: An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function. Affects clojure versions 1.8.0-3 – 1.9.0~alpha15-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Clojure is a dynamic programming language that runs on the Java Virtual Machine (JVM). It is designed for functional programming and emphasizes immutability and concurrency. Clojure is widely used for building robust applications due to its simplicity and powerful features. However, versions 1.20 to 1.12.0-alpha5 of Clojure contain a vulnerability that allows attackers to exploit the clojure.core$partial$fn__5920 function, leading to potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability identified as CVE-2024-22871 affects Clojure versions 1.20 to 1.12.0-alpha5. It allows an attacker to cause a denial of service by exploiting the clojure.core$partial$fn__5920 function. This can lead to application crashes or unresponsiveness, severely impacting the availability of services relying on affected versions of Clojure. The vulnerability is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the clojure.core$partial$fn__5920 function in their applications until they can upgrade to a patched version. This may involve refactoring code to eliminate dependencies on this function.
Conclusion
CVE-2024-22871 is a significant vulnerability in Clojure that can lead to denial of service attacks. It is crucial for users of affected versions to update to a patched version to ensure the security and availability of their applications. Utilizing tools like Vulert can further enhance vulnerability management.
See every vulnerability recorded for clojure →
FAQ
CVE-2024-22871 is a vulnerability in Clojure that allows attackers to cause a denial of service through the clojure.core$partial$fn__5920 function.
Clojure versions 1.20 to 1.12.0-alpha5 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider refactoring your code to avoid using the clojure.core$partial$fn__5920 function as a temporary workaround.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for clojure.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
