CVE-2024-22871
1 advisory.
Maven/org.clojure:clojure CVE-2024-22871: high 7.5, EPSS 1.53%
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
Action: Upgrade org.clojure:clojure to 1.11.2 (1.11.x) or 1.12.0-alpha9 (1.12.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.7.0 | 1.11.2 | - |
| 1.12.0-alpha1 | 1.12.0-alpha9 | - |
Fixed versions
| 1.11.2 | 1.12.0-alpha9 |
Sources
- osv: GHSA-vr64-r9qj-h27f
- https://nvd.nist.gov/vuln/detail/CVE-2024-22871
- https://clojure.atlassian.net/browse/CLJ-2839
- https://github.com/clojure/clojure
- https://hackmd.io/%40fe1w0/rymmJGida
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T
CVE-2024-22871 · published · modified · JSON