Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qZ3hjLThtd3EtOXhxd84AA4mo

Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

Permalink: https://github.com/advisories/GHSA-jgxc-8mwq-9xqw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qZ3hjLThtd3EtOXhxd84AA4mo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 11 months ago
Updated: 10 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-jgxc-8mwq-9xqw, CVE-2017-20189
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-20189
• https://github.com/frohoff/ysoserial/pull/68/files
• https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3
• https://clojure.atlassian.net/browse/CLJ-2204
• https://hackmd.io/%40fe1w0/HyefvRQKp
• https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378
• https://groups.google.com/d/msg/clojure/WaL3hHzsevI/7zHU-L7LBQAJ
• https://github.com/advisories/GHSA-jgxc-8mwq-9xqw

Repository: https://github.com/frohoff/ysoserial
Blast Radius: 36.5

Affected Packages