Clojure Deref (Mar 8, 2024)

[NewsBot]

A new Clojure blog post/announcement has been posted!

Welcome to the Clojure Deref! This is a weekly link/news roundup for the Clojure ecosystem (feed: RSS). Thanks to Anton Fonarev for link aggregation.

From the core

Last week CVE-2024-22871 detailed in GHSA-vr64-r9qj-h27f was filed. I’ve added the relevant info to the latter link so read there for the details. The important takeaway here is that you should never read serialized objects from an untrusted source (usually this is via ObjectInputStream.readObject() if you’re grepping your source code). There are an open-ended number of ways an attacker can craft malic...

Get the full details here: https://clojure.org/news/2024/03/08/deref