CVE-2020-17521

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-17521
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17521.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-17521
Aliases
Downstream
Related
Published
2020-12-07T20:15:12.633Z
Modified
2026-07-08T05:56:34.089112809Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.0"
                },
                {
                    "last_affected": "11.3.1"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "oracle:insurance_policy_administration",
            "cpes": [
                "cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "17.12.0"
                },
                {
                    "last_affected": "17.12.10"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "oracle:primavera_gateway",
            "cpes": [
                "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "17.7"
                },
                {
                    "last_affected": "17.12"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "oracle:primavera_unifier",
            "cpes": [
                "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.1.0-NA"
                },
                {
                    "last_affected": "2.1.0-NA"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "apache:atlas",
            "cpes": [
                "cpe:2.3:a:apache:atlas:2.1.0:-:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0-alpha1"
                },
                {
                    "last_affected": "4.0.0-alpha1"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "apache:groovy",
            "cpes": [
                "cpe:2.3:a:apache:groovy:4.0.0:alpha1:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "6.2.1.0"
                },
                {
                    "last_affected": "6.2.1.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:agile_engineering_data_management",
            "cpes": [
                "cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "9.3.3"
                },
                {
                    "last_affected": "9.3.3"
                },
                {
                    "introduced": "9.3.6"
                },
                {
                    "last_affected": "9.3.6"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:agile_plm",
            "cpes": [
                "cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "3.4"
                },
                {
                    "last_affected": "3.4"
                },
                {
                    "introduced": "3.6"
                },
                {
                    "last_affected": "3.6"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:agile_plm_mcad_connector",
            "cpes": [
                "cpe:2.3:a:oracle:agile_plm_mcad_connector:3.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "12.2.1.3.0"
                },
                {
                    "last_affected": "12.2.1.3.0"
                },
                {
                    "introduced": "12.2.1.4.0"
                },
                {
                    "last_affected": "12.2.1.4.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:business_process_management_suite",
            "cpes": [
                "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "11.3.0.9.0"
                },
                {
                    "last_affected": "11.3.0.9.0"
                },
                {
                    "introduced": "12.0.0.3"
                },
                {
                    "last_affected": "12.0.0.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:communications_brm_-_elastic_charging_engine",
            "cpes": [
                "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "8.4.0.0"
                },
                {
                    "last_affected": "8.4.0.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:communications_diameter_signaling_router",
            "cpes": [
                "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4.0.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "7.1"
                },
                {
                    "last_affected": "7.1"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:communications_evolved_communications_application_server",
            "cpes": [
                "cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.0"
                },
                {
                    "introduced": "6.1"
                },
                {
                    "last_affected": "6.1"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:communications_services_gatekeeper",
            "cpes": [
                "cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "7.0.2"
                },
                {
                    "last_affected": "7.0.2"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:healthcare_data_repository",
            "cpes": [
                "cpe:2.3:a:oracle:healthcare_data_repository:7.0.2:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "5.6"
                },
                {
                    "last_affected": "5.6"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:hospitality_opera_5",
            "cpes": [
                "cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "6.2"
                },
                {
                    "last_affected": "6.2"
                },
                {
                    "introduced": "6.3"
                },
                {
                    "last_affected": "6.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:ilearning",
            "cpes": [
                "cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "9.2.6.0"
                },
                {
                    "last_affected": "9.2.6.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:jd_edwards_enterpriseone_orchestrator",
            "cpes": [
                "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.6.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "16.1"
                },
                {
                    "last_affected": "16.1"
                },
                {
                    "introduced": "16.2"
                },
                {
                    "last_affected": "16.2"
                },
                {
                    "introduced": "18.8"
                },
                {
                    "last_affected": "18.8"
                },
                {
                    "introduced": "19.12"
                },
                {
                    "last_affected": "19.12"
                },
                {
                    "introduced": "20.12"
                },
                {
                    "last_affected": "20.12"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:primavera_unifier",
            "cpes": [
                "cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "15.0.3.0"
                },
                {
                    "last_affected": "15.0.3.0"
                },
                {
                    "introduced": "16.0.3.0"
                },
                {
                    "last_affected": "16.0.3.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:retail_bulk_data_integration",
            "cpes": [
                "cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "16.0.3"
                },
                {
                    "last_affected": "16.0.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:retail_merchandising_system",
            "cpes": [
                "cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "14.1.3.10"
                },
                {
                    "last_affected": "14.1.3.10"
                },
                {
                    "introduced": "15.0.3.5"
                },
                {
                    "last_affected": "15.0.3.5"
                },
                {
                    "introduced": "16.0.3.5"
                },
                {
                    "last_affected": "16.0.3.5"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:retail_store_inventory_management",
            "cpes": [
                "cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.5:*:*:*:*:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/groovy

Affected ranges

Type
GIT
Repo
https://github.com/apache/groovy
Events
Introduced
837dc41fe6b8e4c96abaeaa481a52e1d58e9c80f
Last affected
a21733c9e20b208a614f890fffb0dd42ab3650c7
Introduced
cfea02483ef46c89eae66d4af932a725574edc4d
Last affected
0e6f3ac4a641d1ef387ce9eba96be1ebe917c27f
Introduced
60d50180e756fa75e45d78357f36285fcdf62846
Last affected
6eb8bbbf62120a29cae04d3cdddf0e4e28954760
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.4.20"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "last_affected": "2.5.13"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.6"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17521.json"