CVE-2020-17521
Information Disclosure in Apache Groovy
5.5
MEDIUM
CVSS 3.1
EPSS 1.1%
描述
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
如何修補 CVE-2020-17521
要修補 CVE-2020-17521,請將受影響套件升級到下列已修補版本。
- —升級至 2.4.21-1 或更新版本
- —升級至 2.4.21 或更新版本
- —升級至 2.4.21 或更新版本
CVE-2020-17521 正在被利用嗎?
低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 2.4.21-1
- >= 2.0.0, < 2.4.21
- >= 2.0.0, < 2.4.21
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |