This repository has been archived by the owner on Jun 16, 2023. It is now read-only.
CVE-2020-17521 (Medium) detected in groovy-2.5.12.jar #16
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
CVE-2020-17521 - Medium Severity Vulnerability
Groovy: A powerful, dynamic language for the JVM
Library home page: https://groovy-lang.org
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.codehaus.groovy/groovy/2.5.12/c5a65ece40ef0030e6958af990bd6d83b4e206ec/groovy-2.5.12.jar
Dependency Hierarchy:
Found in HEAD commit: 4cb9afca7b4ab356e0863ec7515cb10a779ea02d
Found in base branch: master
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Publish Date: 2020-12-07
URL: CVE-2020-17521
Base Score Metrics:
Type: Upgrade version
Origin: https://issues.apache.org/jira/browse/GROOVY-9824
Release Date: 2020-12-07
Fix Resolution (org.codehaus.groovy:groovy): 2.5.14
Direct dependency fix Resolution (org.gretty:gretty-runner-jetty7): 3.0.6
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: