CVE-2017-20189 Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization
CriticalCVSS 9.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.clojure/clojure(Maven) | < 1.9.0 | 1.9.0 |
| org.clojure/clojure(Maven) | = 1.0.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.1.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.2.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.2.1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-RC0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-alpha5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-alpha6 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-alpha7 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-alpha8 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-beta1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-beta2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.3.0-beta3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-alpha1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-alpha2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-alpha3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-alpha4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-alpha5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-beta1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-beta2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-beta3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-beta4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-beta5 | No fix listed |
Show 95 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.clojure/clojure(Maven) | = 1.4.0-beta6 | No fix listed |
| org.clojure/clojure(Maven) | = 1.4.0-beta7 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC14 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC15 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC16 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC17 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-RC6 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-alpha1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-alpha2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-alpha3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-alpha4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-alpha5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-alpha6 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-alpha7 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta10 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta11 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta12 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta13 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta7 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta8 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.0-beta9 | No fix listed |
| org.clojure/clojure(Maven) | = 1.5.1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-RC1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-RC2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-RC3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-RC4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-alpha1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-alpha2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-alpha3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-beta1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.6.0-beta2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-RC1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-RC2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-alpha1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-alpha2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-alpha3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-alpha4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-alpha5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-alpha6 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-beta1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-beta2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.7.0-beta3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-RC1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-RC2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-RC3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-RC4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-RC5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-alpha1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-alpha2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-alpha3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-alpha4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-alpha5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-beta1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.8.0-beta2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-RC1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-RC2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha10 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha11 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha12 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha13 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha14 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha15 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha16 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha17 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha18 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha19 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha20 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha4 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha5 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha6 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha7 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha8 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-alpha9 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-beta1 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-beta2 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-beta3 | No fix listed |
| org.clojure/clojure(Maven) | = 1.9.0-beta4 | No fix listed |
| debian/clojure(Debian:12) | < 1.9.0-1 | 1.9.0-1 |
| debian/clojure(Debian:13) | < 1.9.0-1 | 1.9.0-1 |
| debian/clojure(Debian:14) | < 1.9.0-1 | 1.9.0-1 |
| clojure | < 1.9.0 | 1.9.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- clojure.atlassian.net exploit patch vendor-advisory
- github.com product
- groups.google.com
- hackmd.io exploit third-party-advisory
- security.netapp.com
- security.snyk.io patch third-party-advisory
- Debian Security Tracker CVE-2017-20189 vendor-advisory
- github.com