GHSA-rcjj-h6gh-jf3r
Information Disclosure in Apache Groovy
At a glance
- Published
- Updated
- CVE
- CVE-2020-17521
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.codehaus.groovy:groovy | introduced 2.0.0, fixed 2.4.21 |
| Maven · org.codehaus.groovy:groovy | introduced 2.5.0, fixed 2.5.14 |
| Maven · org.codehaus.groovy:groovy | introduced 3.0.0, fixed 3.0.7 |
| Maven · org.codehaus.groovy:groovy-all | introduced 2.0.0, fixed 2.4.21 |
| Maven · org.codehaus.groovy:groovy-all | introduced 2.5.0, fixed 2.5.14 |
| Maven · org.codehaus.groovy:groovy-all | introduced 3.0.0, fixed 3.0.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-17521 ADVISORY
- https://github.com/apache/groovy/pull/1425 WEB
- https://github.com/apache/groovy/commit/bcbe5c4c76db83736166530647c024ac1e47ef28 WEB
- https://github.com/apache/groovy PACKAGE
- https://groovy-lang.org/security.html#CVE-2020-17521 WEB
- https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3E WEB
- https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E WEB
- https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3E WEB
- https://security.netapp.com/advisory/ntap-20201218-0006 WEB
- https://www.oracle.com//security-alerts/cpujul2021.html WEB
- https://www.oracle.com/security-alerts/cpuApr2021.html WEB
- https://www.oracle.com/security-alerts/cpuapr2022.html WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
- https://www.oracle.com/security-alerts/cpujan2022.html WEB
- https://www.oracle.com/security-alerts/cpujul2022.html WEB
- https://www.oracle.com/security-alerts/cpuoct2021.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |