NetSight
IP …
medium5.5

CVE-2020-17521

Information Disclosure in Apache Groovy

Impact

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.codehaus.groovy:groovy>= 2.0.0, < 2.4.212.4.21
mavenorg.codehaus.groovy:groovy-all>= 2.0.0, < 2.4.212.4.21

Affected products

VendorProductAffected versions
ApacheGroovy
from 2.0.0 through 2.4.20
from 2.5.0 through 2.5.13
from 3.0.0 through 3.0.6
Version 4.0.0
NetappSnapcenter
All versions
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleAgile Plm Mcad Connector
Versions 3.4, 3.6
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.6
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Brm - Elastic Charging Engine
Versions 11.3.0.9.0, 12.0.0.3
OracleCommunications Diameter Signaling Router
Version 8.4.0.0
OracleCommunications Evolved Communications Application Server
Version 7.1
OracleCommunications Services Gatekeeper
Versions 6.0, 6.1, 7.0
OracleHealthcare Data Repository
Version 7.0.2
OracleHospitality Opera 5
Version 5.6

Weakness classification

CWE-379

References