CVE-2017-20189

    Dashboard / Vulnerabilities / CVE-2017-20189

    CVE-2017-20189

    Published: 22 Jan 2024Last Modified: 8 Jul 2026

    Summary:

    Details: In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

    References: https://security.netapp.com/advisory/ntap-20241108-0002/, https://clojure.atlassian.net/browse/CLJ-2204, https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3, https://github.com/frohoff/ysoserial/pull/68/files, https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378, https://hackmd.io/%40fe1w0/HyefvRQKp

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -841fa60b41bc74367fb16ec65d025ea5bde7a617

    Affected versions

    clojure-1.9.0-RC2
    clojure-1.9.0-RC1
    clojure-1.9.0-beta4
    clojure-1.9.0-beta3
    clojure-1.9.0-beta2
    clojure-1.9.0-beta1
    clojure-1.9.0-alpha20
    clojure-1.9.0-alpha19
    clojure-1.9.0-alpha17
    clojure-1.9.0-alpha16
    clojure-1.9.0-alpha15
    clojure-1.9.0-alpha14
    clojure-1.9.0-alpha13
    clojure-1.9.0-alpha12
    clojure-1.9.0-alpha11
    clojure-1.9.0-alpha10
    clojure-1.9.0-alpha9
    clojure-1.9.0-alpha8
    clojure-1.9.0-alpha6
    clojure-1.9.0-alpha5
    clojure-1.9.0-alpha4
    clojure-1.9.0-alpha3
    clojure-1.9.0-alpha1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-20189 | CVE-DB