Vulnerability	Vulnerable Version
H Infinite Loop Affected versions of this package are vulnerable to Infinite Loop initiated through deserialization, via the `clojure.core$partial$fn__5920` function that can be obtained by reading the jar file. An attacker can cause a system to become unresponsive or crash by sending crafted inputs. How to fix Infinite Loop? Upgrade `org.clojure:clojure` to version 1.11.2, 1.12.0-alpha9 or higher.	[1.2.0,1.11.2)[1.12.0-alpha1,1.12.0-alpha9)
M Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data. If a server can deserialize objects from an untrusted source, it is possible to craft a serialized object that runs arbitrary code on deserialization. Note: The attacker would likely need to be in a position with elevated trust in order to pass a malicious payload and the attack depends on conditions that are not entirely under his control. How to fix Deserialization of Untrusted Data? Upgrade `org.clojure:clojure` to version 1.9.0 or higher.	[1.2.0,1.9.0)

Infinite Loop

Affected versions of this package are vulnerable to Infinite Loop initiated through deserialization, via the clojure.core$partial$fn__5920 function that can be obtained by reading the jar file. An attacker can cause a system to become unresponsive or crash by sending crafted inputs.

How to fix Infinite Loop?

Upgrade org.clojure:clojure to version 1.11.2, 1.12.0-alpha9 or higher.

[1.2.0,1.11.2)[1.12.0-alpha1,1.12.0-alpha9)

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. If a server can deserialize objects from an untrusted source, it is possible to craft a serialized object that runs arbitrary code on deserialization.

Note:

The attacker would likely need to be in a position with elevated trust in order to pass a malicious payload and the attack depends on conditions that are not entirely under his control.

How to fix Deserialization of Untrusted Data?

Upgrade org.clojure:clojure to version 1.9.0 or higher.

[1.2.0,1.9.0)

Go back to all versions of this package