CVEvulnerability

CVE-2020-17521

5.5 MEDIUM Published 2020-12-07 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2020-12-07
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N

Description

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Affected configurations

• apache groovy (>= 2.0.0 <= 2.4.20) • apache groovy (>= 2.5.0 <= 2.5.13) • apache groovy (>= 3.0.0 <= 3.0.6) • apache groovy 4.0.0 • netapp snapcenter • oracle agile engineering data management 6.2.1.0 • oracle agile plm mcad connector 3.4 • oracle agile plm mcad connector 3.6 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.6 • oracle business process management suite 12.2.1.3.0 • oracle business process management suite 12.2.1.4.0 • oracle communications brm - elastic charging engine 11.3.0.9.0 • oracle communications brm - elastic charging engine 12.0.0.3 • oracle communications diameter signaling router 8.4.0.0 • oracle communications evolved communications application server 7.1 • oracle communications services gatekeeper 6.0 • oracle communications services gatekeeper 6.1 • oracle communications services gatekeeper 7.0 • oracle healthcare data repository 7.0.2 • oracle hospitality opera 5 5.6 • oracle ilearning 6.2 • oracle ilearning 6.3 • oracle insurance policy administration (>= 11.0 <= 11.3.1) • oracle jd edwards enterpriseone orchestrator 9.2.6.0 • oracle primavera gateway (>= 17.12.0 <= 17.12.10) • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle primavera unifier 20.12 • oracle retail bulk data integration 15.0.3.0 • oracle retail bulk data integration 16.0.3.0 • oracle retail merchandising system 16.0.3 • oracle retail store inventory management 14.1.3.10 • oracle retail store inventory management 15.0.3.5 • oracle retail store inventory management 16.0.3.5 • apache atlas 2.1.0

References