GHSA-qg25-hgjv-cg9q

Source

https://github.com/advisories/GHSA-qg25-hgjv-cg9q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qg25-hgjv-cg9q/GHSA-qg25-hgjv-cg9q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qg25-hgjv-cg9q

Aliases

CVE-2015-3253

Published

2022-05-13T01:25:41Z

Modified

2024-10-17T16:23:29.123790Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy

Details

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Database specific

{
    "nvd_published_at": "2015-08-13T14:59:00Z",
    "cwe_ids": [
        "CWE-74"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:16:53Z"
}

References

Affected packages

Maven / org.codehaus.groovy:groovy

Package

Name: org.codehaus.groovy:groovy; View open source insights on deps.dev
Purl: pkg:maven/org.codehaus.groovy/groovy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.7.0

Fixed

2.4.4

Affected versions

1.*

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7.10

1.7.11

1.8.0-beta-1

1.8.0-beta-2

1.8.0-beta-3

1.8.0-beta-4

1.8.0-rc-1

1.8.0-rc-2

1.8.0-rc-3

1.8.0-rc-4

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9.0-beta-1

1.9.0-beta-2

1.9.0-beta-3

1.9.0-beta-4

2.*

2.0.0-beta-1

2.0.0-beta-2

2.0.0-beta-3

2.0.0-rc-1

2.0.0-rc-2

2.0.0-rc-3

2.0.0-rc-4

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.0-beta-1

2.1.0-rc-1

2.1.0-rc-2

2.1.0-rc-3

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0-beta-1

2.2.0-beta-2

2.2.0-rc-1

2.2.0-rc-2

2.2.0-rc-3

2.2.0

2.2.1

2.2.2

2.3.0-beta-1

2.3.0-beta-2

2.3.0-rc-1

2.3.0-rc-2

2.3.0-rc-4

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.4.0-beta-1

2.4.0-beta-2

2.4.0-beta-3

2.4.0-beta-4

2.4.0-rc-1

2.4.0-rc-2

2.4.0

2.4.1

2.4.2

2.4.3

Database specific

{
    "last_known_affected_version_range": "<= 2.4.3"
}

Maven / org.codehaus.groovy:groovy-all