{"id":"GHSA-rcjj-h6gh-jf3r","summary":"Information Disclosure in Apache Groovy","details":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","aliases":["CVE-2020-17521"],"modified":"2024-10-17T16:22:52.000206Z","published":"2020-12-09T19:03:03Z","database_specific":{"github_reviewed_at":"2020-12-09T19:02:34Z","nvd_published_at":"2020-12-07T20:15:00Z","cwe_ids":["CWE-379"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17521"},{"type":"WEB","url":"https://github.com/apache/groovy/pull/1425"},{"type":"WEB","url":"https://github.com/apache/groovy/commit/bcbe5c4c76db83736166530647c024ac1e47ef28"},{"type":"PACKAGE","url":"https://github.com/apache/groovy"},{"type":"WEB","url":"https://groovy-lang.org/security.html#CVE-2020-17521"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3E"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20201218-0006"},{"type":"WEB","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"package":{"name":"org.codehaus.groovy:groovy","ecosystem":"Maven","purl":"pkg:maven/org.codehaus.groovy/groovy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.21"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.0-beta-1","2.1.0-rc-1","2.1.0-rc-2","2.1.0-rc-3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-beta-1","2.2.0-beta-2","2.2.0-rc-1","2.2.0-rc-2","2.2.0-rc-3","2.2.1","2.2.2","2.3.0","2.3.0-beta-1","2.3.0-beta-2","2.3.0-rc-1","2.3.0-rc-2","2.3.0-rc-4","2.3.1","2.3.10","2.3.11","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-beta-1","2.4.0-beta-2","2.4.0-beta-3","2.4.0-beta-4","2.4.0-rc-1","2.4.0-rc-2","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-rcjj-h6gh-jf3r/GHSA-rcjj-h6gh-jf3r.json"}},{"package":{"name":"org.codehaus.groovy:groovy","ecosystem":"Maven","purl":"pkg:maven/org.codehaus.groovy/groovy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.14"}]}],"versions":["2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-rcjj-h6gh-jf3r/GHSA-rcjj-h6gh-jf3r.json"}},{"package":{"name":"org.codehaus.groovy:groovy","ecosystem":"Maven","purl":"pkg:maven/org.codehaus.groovy/groovy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-rcjj-h6gh-jf3r/GHSA-rcjj-h6gh-jf3r.json"}},{"package":{"name":"org.codehaus.groovy:groovy-all","ecosystem":"Maven","purl":"pkg:maven/org.codehaus.groovy/groovy-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.21"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.0-beta-1","2.1.0-rc-1","2.1.0-rc-2","2.1.0-rc-3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-beta-1","2.2.0-beta-2","2.2.0-rc-1","2.2.0-rc-2","2.2.0-rc-3","2.2.1","2.2.2","2.3.0","2.3.0-beta-1","2.3.0-beta-2","2.3.0-rc-1","2.3.0-rc-2","2.3.0-rc-4","2.3.1","2.3.10","2.3.11","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-beta-1","2.4.0-beta-2","2.4.0-beta-3","2.4.0-beta-4","2.4.0-rc-1","2.4.0-rc-2","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.3","2.4.4","2.4.5","2.4.6","2.4.6-jenkins-1","2.4.7","2.4.8","2.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-rcjj-h6gh-jf3r/GHSA-rcjj-h6gh-jf3r.json"}},{"package":{"name":"org.codehaus.groovy:groovy-all","ecosystem":"Maven","purl":"pkg:maven/org.codehaus.groovy/groovy-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.14"}]}],"versions":["2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-rcjj-h6gh-jf3r/GHSA-rcjj-h6gh-jf3r.json"}},{"package":{"name":"org.codehaus.groovy:groovy-all","ecosystem":"Maven","purl":"pkg:maven/org.codehaus.groovy/groovy-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-rcjj-h6gh-jf3r/GHSA-rcjj-h6gh-jf3r.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}