CVE-2017-20189

9.8

CRITICALCVSS v3

Published

January 22, 2024

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

frohoff/ysoserial

GitHubA proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

NVD

clojure/clojure

GitHubThe Clojure programming language

< 1.9.0NVD

Clojure

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

A port of Clojure to the CLR.

< 1.9.0NVD

Clojure

ChocolateyClojure is a dynamic programming language that targets the Java Virtual Machine. **NOTE**: This package is automatically updated. If it is out of date and there is no newer package submitted, please use the `Contact Maintainers` functionality to alert them.

< 1.9.0NVD

clojure

RubyGemsA JavaGem-ized version of Clojure

< 1.9.0NVD

clojure

NPM

< 1.9.0NVD

Security Advisories

CVE-2017-20189

Description

More on this CVE