The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Groovy | Apache | 1.7.0 (including) | 1.7.0 (including) |
| Groovy | Apache | 1.7.0-beta_1 (including) | 1.7.0-beta_1 (including) |
| Groovy | Apache | 1.7.0-beta_2 (including) | 1.7.0-beta_2 (including) |
| Groovy | Apache | 1.7.0-rc1 (including) | 1.7.0-rc1 (including) |
| Groovy | Apache | 1.7.0-rc2 (including) | 1.7.0-rc2 (including) |
| Groovy | Apache | 1.7.1 (including) | 1.7.1 (including) |
| Groovy | Apache | 1.7.2 (including) | 1.7.2 (including) |
| Groovy | Apache | 1.7.3 (including) | 1.7.3 (including) |
| Groovy | Apache | 1.7.4 (including) | 1.7.4 (including) |
| Groovy | Apache | 1.7.5 (including) | 1.7.5 (including) |
| Groovy | Apache | 1.7.6 (including) | 1.7.6 (including) |
| Groovy | Apache | 1.7.7 (including) | 1.7.7 (including) |
| Groovy | Apache | 1.7.8 (including) | 1.7.8 (including) |
| Groovy | Apache | 1.7.9 (including) | 1.7.9 (including) |
| Groovy | Apache | 1.7.10 (including) | 1.7.10 (including) |
| Groovy | Apache | 1.7.11 (including) | 1.7.11 (including) |
| Groovy | Apache | 1.8.0 (including) | 1.8.0 (including) |
| Groovy | Apache | 1.8.0-beta_1 (including) | 1.8.0-beta_1 (including) |
| Groovy | Apache | 1.8.0-beta_2 (including) | 1.8.0-beta_2 (including) |
| Groovy | Apache | 1.8.0-beta_3 (including) | 1.8.0-beta_3 (including) |
| Groovy | Apache | 1.8.0-beta_4 (including) | 1.8.0-beta_4 (including) |
| Groovy | Apache | 1.8.0-rc1 (including) | 1.8.0-rc1 (including) |
| Groovy | Apache | 1.8.0-rc2 (including) | 1.8.0-rc2 (including) |
| Groovy | Apache | 1.8.0-rc3 (including) | 1.8.0-rc3 (including) |
| Groovy | Apache | 1.8.0-rc4 (including) | 1.8.0-rc4 (including) |
| Groovy | Apache | 1.8.1 (including) | 1.8.1 (including) |
| Groovy | Apache | 1.8.2 (including) | 1.8.2 (including) |
| Groovy | Apache | 1.8.3 (including) | 1.8.3 (including) |
| Groovy | Apache | 1.8.4 (including) | 1.8.4 (including) |
| Groovy | Apache | 1.8.5 (including) | 1.8.5 (including) |
| Groovy | Apache | 1.8.6 (including) | 1.8.6 (including) |
| Groovy | Apache | 1.8.7 (including) | 1.8.7 (including) |
| Groovy | Apache | 1.8.8 (including) | 1.8.8 (including) |
| Groovy | Apache | 1.8.9 (including) | 1.8.9 (including) |
| Groovy | Apache | 1.9.0 (including) | 1.9.0 (including) |
| Groovy | Apache | 1.9.0-beta_1 (including) | 1.9.0-beta_1 (including) |
| Groovy | Apache | 1.9.0-beta_3 (including) | 1.9.0-beta_3 (including) |
| Groovy | Apache | 1.9.0-beta_4 (including) | 1.9.0-beta_4 (including) |
| Groovy | Apache | 2.0.0 (including) | 2.0.0 (including) |
| Groovy | Apache | 2.0.0-beta_1 (including) | 2.0.0-beta_1 (including) |
| Groovy | Apache | 2.0.0-beta_2 (including) | 2.0.0-beta_2 (including) |
| Groovy | Apache | 2.0.0-beta_3 (including) | 2.0.0-beta_3 (including) |
| Groovy | Apache | 2.0.0-rc1 (including) | 2.0.0-rc1 (including) |
| Groovy | Apache | 2.0.0-rc2 (including) | 2.0.0-rc2 (including) |
| Groovy | Apache | 2.0.0-rc3 (including) | 2.0.0-rc3 (including) |
| Groovy | Apache | 2.0.0-rc4 (including) | 2.0.0-rc4 (including) |
| Groovy | Apache | 2.0.1 (including) | 2.0.1 (including) |
| Groovy | Apache | 2.0.2 (including) | 2.0.2 (including) |
| Groovy | Apache | 2.0.3 (including) | 2.0.3 (including) |
| Groovy | Apache | 2.0.4 (including) | 2.0.4 (including) |
| Groovy | Apache | 2.0.5 (including) | 2.0.5 (including) |
| Groovy | Apache | 2.0.6 (including) | 2.0.6 (including) |
| Groovy | Apache | 2.0.7 (including) | 2.0.7 (including) |
| Groovy | Apache | 2.0.8 (including) | 2.0.8 (including) |
| Groovy | Apache | 2.1.0 (including) | 2.1.0 (including) |
| Groovy | Apache | 2.1.0-beta_1 (including) | 2.1.0-beta_1 (including) |
| Groovy | Apache | 2.1.0-rc1 (including) | 2.1.0-rc1 (including) |
| Groovy | Apache | 2.1.0-rc2 (including) | 2.1.0-rc2 (including) |
| Groovy | Apache | 2.1.0-rc3 (including) | 2.1.0-rc3 (including) |
| Groovy | Apache | 2.1.1 (including) | 2.1.1 (including) |
| Groovy | Apache | 2.1.2 (including) | 2.1.2 (including) |
| Groovy | Apache | 2.1.3 (including) | 2.1.3 (including) |
| Groovy | Apache | 2.1.4 (including) | 2.1.4 (including) |
| Groovy | Apache | 2.1.5 (including) | 2.1.5 (including) |
| Groovy | Apache | 2.1.6 (including) | 2.1.6 (including) |
| Groovy | Apache | 2.1.7 (including) | 2.1.7 (including) |
| Groovy | Apache | 2.1.8 (including) | 2.1.8 (including) |
| Groovy | Apache | 2.1.9 (including) | 2.1.9 (including) |
| Groovy | Apache | 2.2.0 (including) | 2.2.0 (including) |
| Groovy | Apache | 2.2.0-beta_1 (including) | 2.2.0-beta_1 (including) |
| Groovy | Apache | 2.2.0-beta_2 (including) | 2.2.0-beta_2 (including) |
| Groovy | Apache | 2.2.0-rc1 (including) | 2.2.0-rc1 (including) |
| Groovy | Apache | 2.2.0-rc2 (including) | 2.2.0-rc2 (including) |
| Groovy | Apache | 2.2.0-rc3 (including) | 2.2.0-rc3 (including) |
| Groovy | Apache | 2.2.1 (including) | 2.2.1 (including) |
| Groovy | Apache | 2.2.2 (including) | 2.2.2 (including) |
| Groovy | Apache | 2.3.0 (including) | 2.3.0 (including) |
| Groovy | Apache | 2.3.0-beta_1 (including) | 2.3.0-beta_1 (including) |
| Groovy | Apache | 2.3.0-beta_2 (including) | 2.3.0-beta_2 (including) |
| Groovy | Apache | 2.3.0-rc1 (including) | 2.3.0-rc1 (including) |
| Groovy | Apache | 2.3.0-rc2 (including) | 2.3.0-rc2 (including) |
| Groovy | Apache | 2.3.0-rc3 (including) | 2.3.0-rc3 (including) |
| Groovy | Apache | 2.3.1 (including) | 2.3.1 (including) |
| Groovy | Apache | 2.3.2 (including) | 2.3.2 (including) |
| Groovy | Apache | 2.3.3 (including) | 2.3.3 (including) |
| Groovy | Apache | 2.3.4 (including) | 2.3.4 (including) |
| Groovy | Apache | 2.3.5 (including) | 2.3.5 (including) |
| Groovy | Apache | 2.3.6 (including) | 2.3.6 (including) |
| Groovy | Apache | 2.3.7 (including) | 2.3.7 (including) |
| Groovy | Apache | 2.3.8 (including) | 2.3.8 (including) |
| Groovy | Apache | 2.3.9 (including) | 2.3.9 (including) |
| Groovy | Apache | 2.3.10 (including) | 2.3.10 (including) |
| Groovy | Apache | 2.3.11 (including) | 2.3.11 (including) |
| Groovy | Apache | 2.4.0 (including) | 2.4.0 (including) |
| Groovy | Apache | 2.4.0-beta_1 (including) | 2.4.0-beta_1 (including) |
| Groovy | Apache | 2.4.0-beta_2 (including) | 2.4.0-beta_2 (including) |
| Groovy | Apache | 2.4.0-beta_3 (including) | 2.4.0-beta_3 (including) |
| Groovy | Apache | 2.4.0-beta_4 (including) | 2.4.0-beta_4 (including) |
| Groovy | Apache | 2.4.0-rc1 (including) | 2.4.0-rc1 (including) |
| Groovy | Apache | 2.4.0-rc2 (including) | 2.4.0-rc2 (including) |
| Groovy | Apache | 2.4.1 (including) | 2.4.1 (including) |
| Groovy | Apache | 2.4.2 (including) | 2.4.2 (including) |
| Groovy | Apache | 2.4.3 (including) | 2.4.3 (including) |