要点
- CVE-2020-17521 は org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all, atlas (apache) に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 63.6% より高い）。
- 対処：2.4.21, 2.5.14, 3.0.7 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| org.codehaus.groovy:groovy Maven | ≥ 2.0.0, < 2.4.21≥ 2.5.0, < 2.5.14≥ 3.0.0, < 3.0.7
| 2.4.212.5.143.0.7
|
| org.codehaus.groovy:groovy-all Maven | ≥ 2.0.0, < 2.4.21≥ 2.5.0, < 2.5.14≥ 3.0.0, < 3.0.7
| 2.4.212.5.143.0.7
|
| atlas | = 2.1.0
| 修正版なし |
| groovy | = 4.0.0≥ 2.0.0, ≤ 2.4.20≥ 2.5.0, ≤ 2.5.13≥ 3.0.0, ≤ 3.0.6
| 修正版なし |
| agile engineering data management | = 6.2.1.0
| 修正版なし |
| agile plm mcad connector | = 3.4= 3.6
| 修正版なし |
| agile product lifecycle management | = 9.3.3= 9.3.6
| 修正版なし |
| business process management suite | = 12.2.1.3.0= 12.2.1.4.0
| 修正版なし |
| communications brm - elastic charging engine | = 11.3.0.9.0= 12.0.0.3
| 修正版なし |
| communications diameter signaling router | = 8.4.0.0
| 修正版なし |
| communications evolved communications application server | = 7.1
| 修正版なし |
| communications services gatekeeper | = 6.0= 6.1= 7.0
| 修正版なし |
| healthcare data repository | = 7.0.2
| 修正版なし |
| hospitality opera 5 | = 5.6
| 修正版なし |
| ilearning | = 6.2= 6.3
| 修正版なし |
| insurance policy administration | ≥ 11.0, ≤ 11.3.1
| 修正版なし |
| jd edwards enterpriseone orchestrator | = 9.2.6.0
| 修正版なし |
| primavera gateway | ≥ 17.12.0, ≤ 17.12.10
| 修正版なし |
| primavera unifier | = 16.1= 16.2= 18.8= 19.12= 20.12≥ 17.7, ≤ 17.12
| 修正版なし |
| retail bulk data integration | = 15.0.3.0= 16.0.3.0
| 修正版なし |
| retail merchandising system | = 16.0.3
| 修正版なし |
| retail store inventory management | = 14.1.3.10= 15.0.3.5= 16.0.3.5
| 修正版なし |
概要
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
NVD の説明
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
org.codehaus.groovy:groovy のその他の脆弱性
すべて見る →これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン