CVE-2017-20189: Critical severity ibm cognos analytics vulnerability
Clojure could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially crafted serialized object, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20189?
CVE-2017-20189 has a high severity rating due to the potential for remote code execution by attackers.
How do I fix CVE-2017-20189?
To fix CVE-2017-20189, upgrade Clojure to version 1.9.0 or later.
Who is affected by CVE-2017-20189?
CVE-2017-20189 affects versions of Clojure prior to 1.9.0, as well as specific versions of IBM Cognos Analytics.
What type of vulnerability is CVE-2017-20189?
CVE-2017-20189 is categorized as an unsafe deserialization vulnerability.
What could an attacker do by exploiting CVE-2017-20189?
An attacker could execute arbitrary code on the system by sending a specially crafted serialized object.