{"id":"CVE-2017-20189","description":"In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.","cvssScore":9.8,"cvssVersion":"3.1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssMetrics":[{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","sourceName":"CISA-ADP","type":"Secondary"}],"cwes":["CWE-502"],"resolved":"MITIGATED-BY-RASP","published":"2024-01-22","lastModified":"2026-06-17","affectedProducts":[{"vendor":"clojure","product":"clojure","versionEnd":"\u003c1.9.0"}],"totalAffectedProducts":1,"references":[{"url":"https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3","source":"patch-hint","tags":["commit"]},{"url":"https://github.com/frohoff/ysoserial/pull/68/files","source":"osv","tags":["WEB"]},{"url":"https://clojure.atlassian.net/browse/CLJ-2204","source":"osv","tags":["WEB"]},{"url":"https://github.com/clojure/clojure","source":"osv","tags":["PACKAGE"]},{"url":"https://groups.google.com/d/msg/clojure/WaL3hHzsevI/7zHU-L7LBQAJ","source":"osv","tags":["WEB"]},{"url":"https://hackmd.io/%40fe1w0/HyefvRQKp","source":"osv","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002","source":"osv","tags":["WEB"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378","source":"osv","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"reasoning":{"decidingSource":"secure-rule-match","decidingReason":"Promoted to MITIGATED-BY-RASP (security rule): this CVE's weakness (CWE-502: Deserialization of Untrusted Data) can be mitigated by an ARMR deserialization security rule that blocks this class of attack at the JVM level, without requiring a CVE-specific patch.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Maven packages: org.clojure:clojure"},{"rule":"patch-hint","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"References include candidate fix URL (commit tier): https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3"},{"rule":"open-source-maven","stage":"disposition","outcome":"skipped"},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"matched","status":"MITIGATED-BY-RASP","detail":"CWE-502 (Deserialization of Untrusted Data) is mitigable by an ARMR deserialization security rule.","decisive":true},{"rule":"below-action-threshold","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit-published","stage":"disposition","outcome":"skipped"}],"patchHintUrl":"https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3","patchHintTier":"commit","affectedProducts":[{"vendor":"clojure","product":"clojure","isKnown":false,"cpe":"cpe:2.3:a:clojure:clojure:*:*:*:*:*:*:*:*"}],"affectedPackages":[{"name":"org.clojure:clojure","introduced":"0","fixed":"1.9.0"}]},"assessment":{"record":{"state":"active"},"protection":{"level":"full","mechanisms":["security-rule"],"ruleClass":"deserialization"},"action":{"state":"available","type":"security-rule"},"review":{"state":"automated","basis":"inferred"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.01332,"percentile":0.69564},"ssvc":{"available":true,"exploitation":"poc","automatable":"yes","technicalImpact":"total"},"patchHintUrl":"https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3","patchHintTier":"commit"}