PT-2024-6047 · Atlassian+2 · Confluence+2

Fe1W0 · Published 2024-02-28 · Updated 2025-05-28 · CVE-2024-22871

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Clojure versions 1.12.0-alpha5 through 1.20 Clojure versions 1.7.0 through 1.11.1

Description The issue is related to the deserialization of untrusted data, which can allow an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn 5920 function. Any program on the JVM may read serialized objects via java.io.ObjectInputStream.readObject(), and reading serialized objects from an untrusted source is inherently unsafe. The exploit requires crafting a serialized HashMap object with an infinite seq object as a key and sending it to a program that reads serialized objects via ObjectInputStream.readObject(). This will cause the program to enter an infinite loop on the reading thread and thus a denial of service (DoS).

Recommendations For Clojure versions 1.12.0-alpha5 through 1.20, upgrade to a version that is not affected by this issue. For Clojure versions 1.7.0 through 1.11.1, consider disabling the clojure.core$partial$fn 5920 function as a temporary workaround until a patch is available. For Confluence Data Center and Server customers, upgrade to the latest version or one of the specified supported fixed versions:

• Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.21
• Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.8
• Confluence Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.1 As a temporary workaround, consider restricting access to the java.io.ObjectInputStream.readObject() function to minimize the risk of exploitation.

Exploit

Fix

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-06869

CVE-2024-22871

GHSA-VR64-R9QJ-H27F

MGASA-2024-0093

OPENSUSE-SU-2024:13763-1

Affected Products

Confluence

Debian

Red Os

References · 34

• 🔥 https://hackmd.io/%40fe1w0/rymmJGida · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13763-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vr64-r9qj-h27f · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22871 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22871 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-22871 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0093.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22871 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22871 · Security Note