GitHub Advisoryadvisory · Maven

GHSA-jgxc-8mwq-9xqw Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization

CRITICAL Published 2024-01-22 Modified 2025-11-04 Official page ↗
Aliases
CVE-2017-20189
Ecosystem
Maven
Packages
org.clojure:clojure
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-01-22

Affected packages

• Maven org.clojure:clojure: < 1.9.0 → fixed in 1.9.0

Description

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

Related

Alias · CVE (1)

  • CVE-2017-20189 In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References