debian/clojure vulnerabilities

Latest debian/clojure CVEs

Newest publication first

1. CVE-2024-22871 Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service

   Published 2024-02-29

   High·CVSS 7.5

   Any program on the JVM may read serialized objects via java.io.ObjectInputStream.readObject(). Reading serialized objects from an untrusted source is inherently unsafe (this affects any program running on any version of the JVM) and is a prerequisite for this vulnerability. Cloju...

2. CVE-2017-20189 Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization

   Published 2024-01-22

   Critical·CVSS 9.8

   In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.