Log in Start free

Vulnerability · Published Feb 29, 2024 · Assigned by mitre

CVE-2024-22871

High 7.5

In plain English

A high-severity unsafe deserialization in the clojure package (Alpine). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.5%top 25.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20clojure1.11.2-r0ALPINE-CVE-2024-22871
Alpine:v3.21clojure1.11.2-r0ALPINE-CVE-2024-22871
Alpine:v3.22clojure1.11.2-r0ALPINE-CVE-2024-22871
Alpine:v3.23clojure1.11.2-r0ALPINE-CVE-2024-22871
Alpine:v3.24clojure1.11.2-r0ALPINE-CVE-2024-22871
Debian:12clojureno fix listedDEBIAN-CVE-2024-22871
Debian:13clojure1.11.2-1DEBIAN-CVE-2024-22871
Debian:14clojure1.11.2-1DEBIAN-CVE-2024-22871
Mavenorg.clojure:clojure1.12.0-alpha9GHSA-vr64-r9qj-h27f
Mavenorg.clojure:clojure1.11.2GHSA-vr64-r9qj-h27f
Ubuntu:22.04:LTSclojureno fix listedUBUNTU-CVE-2024-22871
Ubuntu:24.04:LTSclojureno fix listedUBUNTU-CVE-2024-22871
Ubuntu:25.10clojureno fix listedUBUNTU-CVE-2024-22871
Ubuntu:26.04:LTSclojureno fix listedUBUNTU-CVE-2024-22871
Ubuntu:26.10clojureno fix listedUBUNTU-CVE-2024-22871

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References