Vulnerability · Published Dec 7, 2020 · Assigned by apache
CVE-2020-17521
Medium 5.5
In plain English
A medium-severity security flaw in Apache Groovy from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | groovy | 2.4.21-1 | DEBIAN-CVE-2020-17521 |
| Debian:13 | groovy | 2.4.21-1 | DEBIAN-CVE-2020-17521 |
| Debian:14 | groovy | 2.4.21-1 | DEBIAN-CVE-2020-17521 |
| Maven | org.codehaus.groovy:groovy | 2.4.21 | GHSA-rcjj-h6gh-jf3r |
| Maven | org.codehaus.groovy:groovy | 2.5.14 | GHSA-rcjj-h6gh-jf3r |
| Maven | org.codehaus.groovy:groovy | 3.0.7 | GHSA-rcjj-h6gh-jf3r |
| Maven | org.codehaus.groovy:groovy-all | 3.0.7 | GHSA-rcjj-h6gh-jf3r |
| Maven | org.codehaus.groovy:groovy-all | 2.5.14 | GHSA-rcjj-h6gh-jf3r |
| Maven | org.codehaus.groovy:groovy-all | 2.4.21 | GHSA-rcjj-h6gh-jf3r |
| Ubuntu:22.04:LTS | groovy | no fix listed | UBUNTU-CVE-2020-17521 |
| Ubuntu:24.04:LTS | groovy | no fix listed | UBUNTU-CVE-2020-17521 |
| Ubuntu:25.10 | groovy | no fix listed | UBUNTU-CVE-2020-17521 |
| Ubuntu:26.04:LTS | groovy | no fix listed | UBUNTU-CVE-2020-17521 |
| Ubuntu:26.10 | groovy | no fix listed | UBUNTU-CVE-2020-17521 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Groovy | 2.0 to 2.4.202.5.0 to 2.5.133.0.0 to 3.0.64.0.0-alpha-1 |
References
- https://groovy-lang.org/security.html#CVE-2020-17521 x_refsource_CONFIRM
- [groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20201218-0006/ x_refsource_CONFIRM
- [atlas-dev] 20210422 [jira] [Created] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521 mailing-list, x_refsource_MLIST
- [atlas-dev] 20210422 [jira] [Updated] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC