-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2020-17521 (Medium) detected in multiple libraries #103
Labels
security vulnerability
Security vulnerability detected by WhiteSource
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE-2020-17521 - Medium Severity Vulnerability
groovy-2.4.6.jar
Groovy: A powerful, dynamic language for the JVM
Library home page: http://groovy-lang.org
Dependency Hierarchy:
groovy-2.4.11.jar
Groovy: A powerful, dynamic language for the JVM
Library home page: http://groovy-lang.org
Path to dependency file: yang-db/unipop-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11.jar,/unipop-core/target/lib/groovy-2.4.11.jar
Dependency Hierarchy:
groovy-2.4.11-indy.jar
Library home page: http://archive.apache.org/dist/tinkerpop/3.1.8/apache-tinkerpop-gremlin-console-3.1.8-bin.zip
Path to dependency file: yang-db/fuse-service/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11-indy.jar,/home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11-indy.jar,/unipop-core/target/lib/groovy-2.4.11-indy.jar,/home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11-indy.jar,/home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11-indy.jar,/home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11-indy.jar,/home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11-indy.jar,/home/wss-scanner/.m2/repository/org/codehaus/groovy/groovy/2.4.11/groovy-2.4.11-indy.jar
Dependency Hierarchy:
Found in HEAD commit: 2e972e558af84884d4f709a1e2336343cfc93337
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Publish Date: 2020-12-07
URL: CVE-2020-17521
Base Score Metrics:
Type: Upgrade version
Origin: https://issues.apache.org/jira/browse/GROOVY-9824
Release Date: 2020-12-07
Fix Resolution: org.codehaus.groovy:groovy-all:2.4.21,2.5.14,3.0.7
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: