{"id":"CVE-2020-17521","aliases":["DEBIAN-CVE-2020-17521","EUVD-2020-1505","GHSA-rcjj-h6gh-jf3r","SUSE-SU-2020:3917-1","UBUNTU-CVE-2020-17521","openSUSE-SU-2020:2367-1","openSUSE-SU-2024:10823-1"],"status":"published","title":"Information Disclosure in Apache Groovy","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01027,"percentile":0.641,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-379"],"published":"2020-12-07T19:22:37Z","modified":"2026-10-26T12:02:28Z","fixes":[{"ecosystem":"Maven","package":"org.codehaus.groovy:groovy","fixed_in":["2.4.21","2.5.14","3.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","fixed_in":["2.4.21","2.5.14","3.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"groovy","fixed_in":["2.4.21-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"groovy","fixed_in":["2.4.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"groovy","fixed_in":["2.4.21-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"groovy","fixed_in":["2.4.21-3.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"groovy","fixed_in":["2.4.21-lp152.2.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"groovy","fixed_in":["2.4.21-2.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.21"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.21"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.21-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.21-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.21"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.0-beta-1","2.1.0-rc-1","2.1.0-rc-2","2.1.0-rc-3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-beta-1","2.2.0-beta-2","2.2.0-rc-1","2.2.0-rc-2","2.2.0-rc-3","2.2.1","2.2.2","2.3.0","2.3.0-beta-1","2.3.0-beta-2","2.3.0-rc-1","2.3.0-rc-2","2.3.0-rc-4","2.3.1","2.3.10","2.3.11","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-beta-1","2.4.0-beta-2","2.4.0-beta-3","2.4.0-beta-4","2.4.0-rc-1","2.4.0-rc-2","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.14"}]}],"versions":["2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6"]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.21"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.0-beta-1","2.1.0-rc-1","2.1.0-rc-2","2.1.0-rc-3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-beta-1","2.2.0-beta-2","2.2.0-rc-1","2.2.0-rc-2","2.2.0-rc-3","2.2.1","2.2.2","2.3.0","2.3.0-beta-1","2.3.0-beta-2","2.3.0-rc-1","2.3.0-rc-2","2.3.0-rc-4","2.3.1","2.3.10","2.3.11","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-beta-1","2.4.0-beta-2","2.4.0-beta-3","2.4.0-beta-4","2.4.0-rc-1","2.4.0-rc-2","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.3","2.4.4","2.4.5","2.4.6","2.4.6-jenkins-1","2.4.7","2.4.8","2.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.14"}]}],"versions":["2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.21-3.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~beta2+isreally1.8.6-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"groovy2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.3+dfsg-2ubuntu1","2.4.3+dfsg-3","2.4.5-1","2.4.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.8-2","2.4.8-3","2.4.14-1","2.4.15-1ubuntu1","2.4.16-1ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.16-2ubuntu1","2.4.17-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.21-8","2.4.21-9","2.4.21-10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.21-10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.21-10build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.21-10","2.4.21-10build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.21-lp152.2.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.21-2.3"}]}]}],"products":[{"vendor":"apache","product":"atlas"},{"vendor":"apache","product":"groovy"},{"vendor":"apache software foundation","product":"apache groovy"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"oracle","product":"agile_engineering_data_management"},{"vendor":"oracle","product":"agile_plm_mcad_connector"},{"vendor":"oracle","product":"agile_product_lifecycle_management"},{"vendor":"oracle","product":"business_process_management_suite"},{"vendor":"oracle","product":"communications_brm_-_elastic_charging_engine"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_evolved_communications_application_server"},{"vendor":"oracle","product":"communications_services_gatekeeper"},{"vendor":"oracle","product":"healthcare_data_repository"},{"vendor":"oracle","product":"hospitality_opera_5"},{"vendor":"oracle","product":"ilearning"},{"vendor":"oracle","product":"insurance_policy_administration"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_orchestrator"},{"vendor":"oracle","product":"primavera_gateway"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"retail_bulk_data_integration"},{"vendor":"oracle","product":"retail_merchandising_system"},{"vendor":"oracle","product":"retail_store_inventory_management"}],"references":[{"url":"https://groovy-lang.org/security.html#CVE-2020-17521","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20201218-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17521","tags":["advisory"]},{"url":"https://github.com/apache/groovy/pull/1425","tags":["web"]},{"url":"https://github.com/apache/groovy/commit/bcbe5c4c76db83736166530647c024ac1e47ef28","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20201218-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rcjj-h6gh-jf3r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-17521","tags":["advisory"]},{"url":"https://github.com/apache/groovy","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203917-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17521","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-17521","tags":["report"]},{"url":"https://issues.apache.org/jira/browse/GROOVY-9824","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/12/06/1","tags":["report"]},{"url":"https://github.com/apache/groovy/commit/4e418d4a34c973a7ec1e822552103043ac13780e","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-17521","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VYXXLFFWNBEOWRTRF6VZBDCDBSGYTI4L/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-17521","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-07T19:22:37Z","modified":"2026-10-08T21:13:54.562Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-1505","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-07T19:22:37Z","modified":"2026-10-08T21:13:54Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-rcjj-h6gh-jf3r","title":"Information Disclosure in Apache Groovy","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-09T19:03:03Z","modified":"2024-10-17T16:18:53Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-379"],"updated_at":"2026-11-02T14:38:11.479492Z"}],"nvd":[{"id":"CVE-2020-17521","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-07T20:15:12.633Z","modified":"2026-10-08T22:16:57.297Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"CVE-2020-17521","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-07T20:15:12.633Z","modified":"2026-10-24T10:30:20.273543613Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"DEBIAN-CVE-2020-17521","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-07T20:15:12.633Z","modified":"2026-10-26T12:02:28.996030741Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"GHSA-rcjj-h6gh-jf3r","title":"Information Disclosure in Apache Groovy","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-09T19:03:03Z","modified":"2024-10-17T16:22:52.000206Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-379"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"UBUNTU-CVE-2020-17521","description":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.","status":"published","published":"2020-12-07T20:15:00Z","modified":"2026-10-17T12:56:18.692032433Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"openSUSE-SU-2020:2367-1","title":"Security update for groovy","description":"This update for groovy fixes the following issues:\n\t  \n- groovy was updated to 2.4.21\n- CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-12-31T19:21:44Z","modified":"2026-02-04T04:39:37.594077Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10823-1","title":"groovy-2.4.21-2.3 on GA media","description":"These are all security issues fixed in the groovy-2.4.21-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:29.851275Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:3917-1","title":"Security update for groovy","description":"This update for groovy fixes the following issues:\n\t  \n- groovy was updated to 2.4.21\n- CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729).\n","status":"published","published":"2020-12-22T13:16:57Z","modified":"2026-02-04T02:45:27.204721Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}