CVE-2017-20189: In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server…

PriorityP259critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.32%

67.3th percentile

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
clojure	clojure	< 1.9.0	1.9.0
clojure	clojure	>= 0 < 1.9.0-1	1.9.0-1
clojure	clojure	>= 0 < 1.9.0-1	1.9.0-1
clojure	clojure	>= 0 < 1.9.0-1	1.9.0-1
clojure	clojure	>= 0 < 1.9.0-1	1.9.0-1
debian	clojure	< clojure 1.9.0-1 (bookworm)	clojure 1.9.0-1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability involves Java deserialization of untrusted objects in Clojure before 1.9.0, where classes can be used to construct a serialized object that executes arbitrary code upon deserialization. Monitor for deserialization of untrusted data in applications using Clojure < 1.9.0. ↗

·Exploitation is only relevant if the server deserializes untrusted objects; scope is listed as local, limiting remote attack surface. ↗
·Fixed in Clojure 1.9.0-1 on all tracked Debian releases (bookworm, bullseye, forky, sid, trixie). Ensure deployed Clojure version is 1.9.0 or later. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv9.8CRITICAL

vendor_debian9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.