CVE-2017-20189

Published: Jan 22, 2024

Modified: Nov 3, 2025

PUBLISHED

Description

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://hackmd.io/%40fe1w0/HyefvRQKp

https://clojure.atlassian.net/browse/CLJ-2204

https://github.com/frohoff/ysoserial/pull/68/files

https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3

https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2017-20189

Description

Affected Products

References