Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

CVE-2017-20189

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

DEBIAN-CVE-2017-20189

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

Deserialization of untrusted data

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

CVE-2017-20189

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

CVE-2017-20189

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

Clojure Security Vulnerabilities

Clojure is a programming language open-sourced by Clojure. A security vulnerability exists in Clojure versions prior to 1.9.0. An attacker exploited the vulnerability to execute arbitrary code...

CVE-2017-20189

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

PT-2024-6048

Name of the Vulnerable Software and Affected Versions Clojure versions prior to 1.9.0 Description The issue is related to the deserialization of untrusted data in the Clojure programming language interpreter. It allows a remote attacker to execute arbitrary code upon deserialization. This is...

CVE-2017-20189

CVE-2017-20189 is a deserialization flaw in Clojure prior to 1.9.0 that allows remote attackers to execute arbitrary code when untrusted serialized objects are deserialized on the server. Public details in connected docs confirm affected Clojure versions (including 1.7.x–1.11.x and 1.12.0-alpha5 ...

CVE-2017-20189

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

Debian dla-3647 : libtrapperkeeper-webserver-jetty9-clojure - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3647 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3647-1 [email protected] https://www.debian.org/lts/security/...

Debian: Security Advisory (DLA-3647-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-3647-1 trapperkeeper-webserver-jetty9-clojure - security update

Bulletin has no description...

[SECURITY] [DLA 3647-1] trapperkeeper-webserver-jetty9-clojure

Debian LTS Advisory DLA-3647-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 07, 2023 https://wiki.debian.org/LTS Package : trapperkeeper-webserver-jetty9-clojure Version : 1.7.0-2+deb10u2 Debian Bug : 1055348 The recent update of jetty9, released as DL...

au.com.permeance:liferay-clojure-integration (=0.1), ch.cern:entwined-stm (>=1.0.0 <=1.0.1) +329 more potentially affected by CVE-2017-20189 via org.clojure:clojure (>=1.2.0 <=1.9.0-beta3)

org.clojure:clojure MAVEN version =1.2.0, =1.0.0, =1.0.0-RELEASE, =1.0.0, =0.1.0, =8.4.0, =0.1.0, =0.0.3, =1.9.921, =0.0.1, =0.0.1, =0.2.2 and more Source cves: CVE-2017-20189 Source advisory: SNYK:JAVA-ORGCLOJURE-5740378...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data. If a server can deserialize objects from an untrusted source, it is possible to craft a serialized object that runs arbitrary code on deserialization. Note: The attacker would likely need to be in a...

CVE-2023-28628

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

Design/Logic Flaw

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

CVE-2023-28628

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...