{"id":"CVE-2020-17521","details":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","aliases":["GHSA-rcjj-h6gh-jf3r"],"modified":"2026-08-27T11:47:09.067335081Z","published":"2020-12-07T20:15:12.633Z","related":["SUSE-SU-2020:3917-1","openSUSE-SU-2020:2367-1","openSUSE-SU-2024:10823-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"oracle:insurance_policy_administration","cpes":["cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.0"},{"last_affected":"11.3.1"}]},{"source":"CPE_RANGE","vendor_product":"oracle:primavera_gateway","cpes":["cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"17.12.0"},{"last_affected":"17.12.10"}]},{"extracted_events":[{"introduced":"17.7"},{"last_affected":"17.12"}],"source":"CPE_RANGE","vendor_product":"oracle:primavera_unifier","cpes":["cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"apache:atlas","cpes":["cpe:2.3:a:apache:atlas:2.1.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.1.0-NA"},{"last_affected":"2.1.0-NA"}]},{"source":"CPE_STRING","vendor_product":"apache:groovy","cpes":["cpe:2.3:a:apache:groovy:4.0.0:alpha1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0.0-alpha1"},{"last_affected":"4.0.0-alpha1"}]},{"extracted_events":[{"introduced":"6.2.1.0"},{"last_affected":"6.2.1.0"}],"source":"CPE_STRING","vendor_product":"oracle:agile_engineering_data_management","cpes":["cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:agile_plm_mcad_connector","cpes":["cpe:2.3:a:oracle:agile_plm_mcad_connector:3.4:*:*:*:*:*:*:*","cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.4"},{"last_affected":"3.4"},{"introduced":"3.6"},{"last_affected":"3.6"}]},{"extracted_events":[{"introduced":"9.3.3"},{"last_affected":"9.3.3"},{"introduced":"9.3.6"},{"last_affected":"9.3.6"}],"source":"CPE_STRING","vendor_product":"oracle:agile_product_lifecycle_management","cpes":["cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:business_process_management_suite","cpes":["cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.2.1.3.0"},{"last_affected":"12.2.1.3.0"},{"introduced":"12.2.1.4.0"},{"last_affected":"12.2.1.4.0"}]},{"extracted_events":[{"introduced":"11.3.0.9.0"},{"last_affected":"11.3.0.9.0"},{"introduced":"12.0.0.3"},{"last_affected":"12.0.0.3"}],"source":"CPE_STRING","vendor_product":"oracle:communications_brm_-_elastic_charging_engine","cpes":["cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.4.0.0"},{"last_affected":"8.4.0.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_diameter_signaling_router"},{"cpes":["cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.1"},{"last_affected":"7.1"}],"source":"CPE_STRING","vendor_product":"oracle:communications_evolved_communications_application_server"},{"source":"CPE_STRING","vendor_product":"oracle:communications_services_gatekeeper","cpes":["cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"6.1"},{"last_affected":"6.1"},{"introduced":"7.0"},{"last_affected":"7.0"}]},{"extracted_events":[{"introduced":"7.0.2"},{"last_affected":"7.0.2"}],"source":"CPE_STRING","vendor_product":"oracle:healthcare_data_repository","cpes":["cpe:2.3:a:oracle:healthcare_data_repository:7.0.2:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:hospitality_opera_5","cpes":["cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.6"},{"last_affected":"5.6"}]},{"cpes":["cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2"},{"last_affected":"6.2"},{"introduced":"6.3"},{"last_affected":"6.3"}],"source":"CPE_STRING","vendor_product":"oracle:ilearning"},{"vendor_product":"oracle:jd_edwards_enterpriseone_orchestrator","cpes":["cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.2.6.0"},{"last_affected":"9.2.6.0"}],"source":"CPE_STRING"},{"vendor_product":"oracle:primavera_unifier","cpes":["cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.1"},{"last_affected":"16.1"},{"introduced":"16.2"},{"last_affected":"16.2"},{"introduced":"18.8"},{"last_affected":"18.8"},{"introduced":"19.12"},{"last_affected":"19.12"},{"introduced":"20.12"},{"last_affected":"20.12"}],"source":"CPE_STRING"},{"vendor_product":"oracle:retail_bulk_data_integration","cpes":["cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0.3.0"},{"last_affected":"15.0.3.0"},{"introduced":"16.0.3.0"},{"last_affected":"16.0.3.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:retail_merchandising_system","cpes":["cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.0.3"},{"last_affected":"16.0.3"}]},{"cpes":["cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.10:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.5:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.1.3.10"},{"last_affected":"14.1.3.10"},{"introduced":"15.0.3.5"},{"last_affected":"15.0.3.5"},{"introduced":"16.0.3.5"},{"last_affected":"16.0.3.5"}],"source":"CPE_STRING","vendor_product":"oracle:retail_store_inventory_management"}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E"},{"type":"ADVISORY","url":"https://groovy-lang.org/security.html#CVE-2020-17521"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20201218-0006/"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/groovy","events":[{"introduced":"837dc41fe6b8e4c96abaeaa481a52e1d58e9c80f"},{"last_affected":"a21733c9e20b208a614f890fffb0dd42ab3650c7"},{"introduced":"cfea02483ef46c89eae66d4af932a725574edc4d"},{"last_affected":"0e6f3ac4a641d1ef387ce9eba96be1ebe917c27f"},{"introduced":"60d50180e756fa75e45d78357f36285fcdf62846"},{"last_affected":"6eb8bbbf62120a29cae04d3cdddf0e4e28954760"}],"database_specific":{"cpe":"cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0.0"},{"last_affected":"2.4.20"},{"introduced":"2.5.0"},{"last_affected":"2.5.13"},{"introduced":"3.0.0"},{"last_affected":"3.0.6"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17521.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}