Описание
In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support |
| devel | not-affected | |
| esm-apps/bionic | needs-triage | |
| esm-apps/focal | not-affected | |
| esm-apps/jammy | not-affected | |
| esm-apps/noble | not-affected | |
| focal | not-affected | 1.10.1-1 |
| jammy | not-affected | |
| lunar | not-affected | |
| mantic | not-affected |
Показывать по
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.
In Clojure before 1.9.0, classes can be used to construct a serialized ...
Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization
Уязвимость интерпретатора языка программирования Clojure, связанная с десериализацией ненадежных данных, позволяющая нарушителю выполнить произвольный код
EPSS
9.8 Critical
CVSS3