CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovys implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Affected Software

Name	Vendor	Start Version	End Version
Groovy	Apache	2.0.0 (including)	2.4.20 (including)
Groovy	Apache	2.5.0 (including)	2.5.13 (including)
Groovy	Apache	3.0.0 (including)	3.0.6 (including)
Groovy	Apache	4.0.0-alpha1 (including)	4.0.0-alpha1 (including)
Red Hat Fuse 7.10	RedHat	groovy	*
Red Hat Integration	RedHat	groovy	*
Red Hat Integration Camel Quarkus 2	RedHat		*
Groovy	Ubuntu	bionic	*
Groovy	Ubuntu	focal	*
Groovy	Ubuntu	groovy	*
Groovy	Ubuntu	hirsute	*
Groovy	Ubuntu	impish	*
Groovy	Ubuntu	kinetic	*
Groovy	Ubuntu	lunar	*
Groovy	Ubuntu	mantic	*
Groovy	Ubuntu	oracular	*
Groovy	Ubuntu	plucky	*
Groovy	Ubuntu	trusty	*
Groovy	Ubuntu	xenial	*
Groovy2	Ubuntu	esm-apps/xenial	*
Groovy2	Ubuntu	trusty	*
Groovy2	Ubuntu	upstream	*
Groovy2	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-17521
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References