CVE-2017-20189
clojure: In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deser...
CVE-2017-20189 is fixed in clojure on 1 platform, first by DEBIAN-CVE-2017-20189, released January 22, 2024. It is not reported as exploited. Patch Radar priority: Urgent.
Urgent
CVSS
9.8
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0133
71st percentile
In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| clojure · Debian 12.15 (bookworm) | 1.9.0-1 | DEBIAN-CVE-2017-20189 | Jan 22, 2024 |
| clojure · Debian 13.5 (trixie) | 1.9.0-1 | DEBIAN-CVE-2017-20189 | Jan 22, 2024 |
| clojure · Debian 14 | 1.9.0-1 | DEBIAN-CVE-2017-20189 | Jan 22, 2024 |