{"id":"GHSA-jgxc-8mwq-9xqw","summary":"Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization","details":"In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.","aliases":["CVE-2017-20189"],"modified":"2025-11-04T01:00:52.362834Z","published":"2024-01-22T06:30:32Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2024-01-22T21:25:51Z","nvd_published_at":"2024-01-22T06:15:07Z","cwe_ids":["CWE-502"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20189"},{"type":"WEB","url":"https://github.com/frohoff/ysoserial/pull/68/files"},{"type":"WEB","url":"https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3"},{"type":"WEB","url":"https://clojure.atlassian.net/browse/CLJ-2204"},{"type":"PACKAGE","url":"https://github.com/clojure/clojure"},{"type":"WEB","url":"https://groups.google.com/d/msg/clojure/WaL3hHzsevI/7zHU-L7LBQAJ"},{"type":"WEB","url":"https://hackmd.io/%40fe1w0/HyefvRQKp"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241108-0002"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378"}],"affected":[{"package":{"name":"org.clojure:clojure","ecosystem":"Maven","purl":"pkg:maven/org.clojure/clojure"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.2.1","1.3.0","1.3.0-RC0","1.3.0-alpha5","1.3.0-alpha6","1.3.0-alpha7","1.3.0-alpha8","1.3.0-beta1","1.3.0-beta2","1.3.0-beta3","1.4.0","1.4.0-alpha1","1.4.0-alpha2","1.4.0-alpha3","1.4.0-alpha4","1.4.0-alpha5","1.4.0-beta1","1.4.0-beta2","1.4.0-beta3","1.4.0-beta4","1.4.0-beta5","1.4.0-beta6","1.4.0-beta7","1.5.0","1.5.0-RC1","1.5.0-RC14","1.5.0-RC15","1.5.0-RC16","1.5.0-RC17","1.5.0-RC2","1.5.0-RC3","1.5.0-RC4","1.5.0-RC5","1.5.0-RC6","1.5.0-alpha1","1.5.0-alpha2","1.5.0-alpha3","1.5.0-alpha4","1.5.0-alpha5","1.5.0-alpha6","1.5.0-alpha7","1.5.0-beta1","1.5.0-beta10","1.5.0-beta11","1.5.0-beta12","1.5.0-beta13","1.5.0-beta2","1.5.0-beta7","1.5.0-beta8","1.5.0-beta9","1.5.1","1.6.0","1.6.0-RC1","1.6.0-RC2","1.6.0-RC3","1.6.0-RC4","1.6.0-alpha1","1.6.0-alpha2","1.6.0-alpha3","1.6.0-beta1","1.6.0-beta2","1.7.0","1.7.0-RC1","1.7.0-RC2","1.7.0-alpha1","1.7.0-alpha2","1.7.0-alpha3","1.7.0-alpha4","1.7.0-alpha5","1.7.0-alpha6","1.7.0-beta1","1.7.0-beta2","1.7.0-beta3","1.8.0","1.8.0-RC1","1.8.0-RC2","1.8.0-RC3","1.8.0-RC4","1.8.0-RC5","1.8.0-alpha1","1.8.0-alpha2","1.8.0-alpha3","1.8.0-alpha4","1.8.0-alpha5","1.8.0-beta1","1.8.0-beta2","1.9.0-RC1","1.9.0-RC2","1.9.0-alpha1","1.9.0-alpha10","1.9.0-alpha11","1.9.0-alpha12","1.9.0-alpha13","1.9.0-alpha14","1.9.0-alpha15","1.9.0-alpha16","1.9.0-alpha17","1.9.0-alpha18","1.9.0-alpha19","1.9.0-alpha2","1.9.0-alpha20","1.9.0-alpha3","1.9.0-alpha4","1.9.0-alpha5","1.9.0-alpha6","1.9.0-alpha7","1.9.0-alpha8","1.9.0-alpha9","1.9.0-beta1","1.9.0-beta2","1.9.0-beta3","1.9.0-beta4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-jgxc-8mwq-9xqw/GHSA-jgxc-8mwq-9xqw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}