groovy-all-2.4.10.jar: 1 vulnerabilities (highest severity is: 5.5) - autoclosed
Closed this issue · 1 comments
Vulnerable Library - groovy-all-2.4.10.jar
Groovy: A powerful, dynamic language for the JVM
Library home page: http://groovy-lang.org
Path to dependency file: /chemistry-opencmis-workbench/pom.xml
Path to vulnerable library: /chemistry-opencmis-workbench/pom.xml
Found in HEAD commit: 7021860f8fce36ffcd9890a8e52fb16d9a1153a9
Vulnerabilities
CVE | Severity | CVSS | Dependency | Type | Fixed in (groovy-all version) | Remediation Possible** |
---|---|---|---|---|---|---|
CVE-2020-17521 | Medium | 5.5 | groovy-all-2.4.10.jar | Direct | 2.4.21 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2020-17521
Vulnerable Library - groovy-all-2.4.10.jar
Groovy: A powerful, dynamic language for the JVM
Library home page: http://groovy-lang.org
Path to dependency file: /chemistry-opencmis-workbench/pom.xml
Path to vulnerable library: /chemistry-opencmis-workbench/pom.xml
Dependency Hierarchy:
- ❌ groovy-all-2.4.10.jar (Vulnerable Library)
Found in HEAD commit: 7021860f8fce36ffcd9890a8e52fb16d9a1153a9
Found in base branch: main
Vulnerability Details
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Publish Date: 2020-12-07
URL: CVE-2020-17521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://issues.apache.org/jira/browse/GROOVY-9824
Release Date: 2020-12-07
Fix Resolution: 2.4.21
Step up your Open Source Security Game with Mend here
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.