CVE-2017-20189

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://clojure.atlassian.net/browse/CLJ-2204Exploit, Patch, Vendor Advisory
https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3Patch
https://github.com/frohoff/ysoserial/pull/68/filesPatch
https://hackmd.io/%40fe1w0/HyefvRQKpExploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378Patch, Third Party Advisory
https://clojure.atlassian.net/browse/CLJ-2204Exploit, Patch, Vendor Advisory
https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3Patch
https://github.com/frohoff/ysoserial/pull/68/filesPatch
https://hackmd.io/%40fe1w0/HyefvRQKpExploit, Third Party Advisory
https://security.netapp.com/advisory/ntap-20241108-0002/
https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378Patch, Third Party Advisory

Timeline

Published: Jan 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-20190Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multi CVE-2017-201913.5A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.pr CVE-2017-201926.1The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form CVE-2017-201936.1The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including,CVE-2017-201945.3The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the CVE-2017-201955.5A vulnerability was found in LUNAD3v AreaLoad up to 1a1103182ed63a06dde63d1712f3262eda19c3ec. It has been rated as critical. This issue affe CVE-2017-201966.3A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affects an unknown part CVE-2017-201977.3A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as crit CVE-2017-201989.3The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume m CVE-2017-201996.5A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality CVE-2017-202003.7A vulnerability has been found in Coinomi up to 1.7.6. This issue affects some unknown processing. Such manipulation leads to cleartext tran CVE-2017-202019.3CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 (32-bit builds) contained a malicious pre-entry-point loader that diverts execution from _