CVE-2020-17521

Description

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.36%

Third-Party Advisory groovy-lang.org Third-Party Advisory netapp.com Third-Party Advisory oracle.com Third-Party Advisory oracle.com Third-Party Advisory oracle.com Third-Party Advisory oracle.com Third-Party Advisory oracle.com Third-Party Advisory oracle.com Third-Party Advisory oracle.com

Affected: Apache Software Foundation Apache Groovy

References

Link	Tags
https://groovy-lang.org/security.html#CVE-2020-17521	third party advisory
https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E	mailing list
https://www.oracle.com/security-alerts/cpujan2021.html	third party advisory patch
https://security.netapp.com/advisory/ntap-20201218-0006/	third party advisory
https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E	mailing list
https://www.oracle.com/security-alerts/cpuApr2021.html	third party advisory patch
https://www.oracle.com//security-alerts/cpujul2021.html	third party advisory patch
https://www.oracle.com/security-alerts/cpuoct2021.html	third party advisory patch
https://www.oracle.com/security-alerts/cpujan2022.html	third party advisory patch
https://www.oracle.com/security-alerts/cpuapr2022.html	third party advisory patch
https://www.oracle.com/security-alerts/cpujul2022.html	third party advisory patch

Frequently Asked Questions

What is the severity of CVE-2020-17521?: CVE-2020-17521 has been scored as a medium severity vulnerability.
How to fix CVE-2020-17521?: To fix CVE-2020-17521, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-17521 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2020-17521 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-17521?: CVE-2020-17521 affects Apache Software Foundation Apache Groovy.