CVE-2020-17521: Infoleak
A flaw was found in Apache Groovy. Groovy makes use of a method for creating temporary directories which is not suitable for security-sensitive contexts and allows for sensitive information leakage. The highest threat from this vulnerability is to data confidentiality.
Other sources
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.codehaus.groovy:groovy-allto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
maven/org.codehaus.groovy:groovy-allto a version that resolves this vulnerability.Fixed in 2.5.14 - Upgrade
Upgrade
maven/org.codehaus.groovy:groovy-allto a version that resolves this vulnerability.Fixed in 2.4.21 - Upgrade
Upgrade
maven/org.codehaus.groovy:groovyto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
maven/org.codehaus.groovy:groovyto a version that resolves this vulnerability.Fixed in 2.5.14 - Upgrade
Upgrade
maven/org.codehaus.groovy:groovyto a version that resolves this vulnerability.Fixed in 2.4.21 - Upgrade
Upgrade
redhat/groovyto a version that resolves this vulnerability.Fixed in 2.4.21 - Upgrade
Upgrade
redhat/groovyto a version that resolves this vulnerability.Fixed in 2.5.14 - Upgrade
Upgrade
redhat/groovyto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
redhat/groovy 4.0.0-alphato a version that resolves this vulnerability.Fixed in 2 - Upgrade
Upgrade
Apache Groovyto a version that resolves this vulnerability.Fixed in 2.4.21 - Upgrade
Upgrade
Apache Groovyto a version that resolves this vulnerability.Fixed in 2.5.14 - Upgrade
Upgrade
Apache Groovyto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
Apache Groovyto a version that resolves this vulnerability.Fixed in 4.0.0-alpha-2 - Configuration
Set the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user to fix the vulnerability for all operating systems and all Groovy versions.
Java (system environment variable used by Groovy/JDK) java.io.tmpdir = Directory exclusively owned by the executing user - Compensating control
For users who cannot easily move to the fixed Groovy versions, use the JDK’s Files#createTempDirectory method instead of Groovy extension methods for creating temporary directories in security-sensitive contexts.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-17521?
CVE-2020-17521 is a vulnerability found in Apache Groovy that allows an attacker to perform a directory traversal attack.
How severe is CVE-2020-17521?
CVE-2020-17521 has a severity rating of 5.5 (medium).
Who is affected by CVE-2020-17521?
The vulnerability affects users of Apache Groovy versions from 2.0.0 up to (but not including) 2.4.21, versions from 2.5.0 up to (but not including) 2.5.14, and versions from 3.0.0 up to (but not including) 3.0.7.
How can I fix CVE-2020-17521?
To fix CVE-2020-17521, users should update Apache Groovy to version 2.4.21, 2.5.14, or 3.0.7.
Where can I find more information about CVE-2020-17521?
More information about CVE-2020-17521 can be found on the Apache Groovy security page, as well as in the provided references.