CNVD-2020-70849

Vulnerability from cnvd - Published: 2020-12-11
VLAI
Title
Apache Groovy Provides资源管理错误漏洞
Description
Apache Groovy是美国阿帕奇（Apache）软件基金会的一种基于Java平台面向对象的编程语言，它结合了Python、Ruby和Smalltalk的许多强大的特性。 Apache Groovy provides产品存在资源管理错误漏洞，该漏洞源于Apache Groovy提供了扩展方法来帮助创建临时目录。在此修复之前，Groovy对这些扩展方法的实现使用的是一个已被取代的Java JDK方法调用，在某些上下文中，这种方法在某些操作系统上可能不安全。目前没有详细的漏洞细节提供。
Severity
低
Patch Name
Apache Groovy Provides资源管理错误漏洞的补丁
Patch Description
Apache Groovy是美国阿帕奇（Apache）软件基金会的一种基于Java平台面向对象的编程语言，它结合了Python、Ruby和Smalltalk的许多强大的特性。 Apache Groovy provides产品存在资源管理错误漏洞，该漏洞源于Apache Groovy提供了扩展方法来帮助创建临时目录。在此修复之前，Groovy对这些扩展方法的实现使用的是一个已被取代的Java JDK方法调用，在某些上下文中，这种方法在某些操作系统上可能不安全。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://issues.apache.org/jira/browse/GROOVY-9824?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel

Reference
https://groovy-lang.org/security.html
Impacted products
Name
['Apache Apache Groovy 4.0.0-alpha-1', 'Apache Apache Groovy >=2.0，<=2.4.20', 'Apache Apache Groovy >=2.5.0，<=2.5.13', 'Apache Apache Groovy >=3.0.0，<=3.0.6']
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-17521",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-17521"
    }
  },
  "description": "Apache Groovy\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u79cd\u57fa\u4e8eJava\u5e73\u53f0\u9762\u5411\u5bf9\u8c61\u7684\u7f16\u7a0b\u8bed\u8a00\uff0c\u5b83\u7ed3\u5408\u4e86Python\u3001Ruby\u548cSmalltalk\u7684\u8bb8\u591a\u5f3a\u5927\u7684\u7279\u6027\u3002\n\nApache Groovy provides\u4ea7\u54c1\u5b58\u5728\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eApache Groovy\u63d0\u4f9b\u4e86\u6269\u5c55\u65b9\u6cd5\u6765\u5e2e\u52a9\u521b\u5efa\u4e34\u65f6\u76ee\u5f55\u3002\u5728\u6b64\u4fee\u590d\u4e4b\u524d\uff0cGroovy\u5bf9\u8fd9\u4e9b\u6269\u5c55\u65b9\u6cd5\u7684\u5b9e\u73b0\u4f7f\u7528\u7684\u662f\u4e00\u4e2a\u5df2\u88ab\u53d6\u4ee3\u7684Java JDK\u65b9\u6cd5\u8c03\u7528\uff0c\u5728\u67d0\u4e9b\u4e0a\u4e0b\u6587\u4e2d\uff0c\u8fd9\u79cd\u65b9\u6cd5\u5728\u67d0\u4e9b\u64cd\u4f5c\u7cfb\u7edf\u4e0a\u53ef\u80fd\u4e0d\u5b89\u5168\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://issues.apache.org/jira/browse/GROOVY-9824?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-70849",
  "openTime": "2020-12-11",
  "patchDescription": "Apache Groovy\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u79cd\u57fa\u4e8eJava\u5e73\u53f0\u9762\u5411\u5bf9\u8c61\u7684\u7f16\u7a0b\u8bed\u8a00\uff0c\u5b83\u7ed3\u5408\u4e86Python\u3001Ruby\u548cSmalltalk\u7684\u8bb8\u591a\u5f3a\u5927\u7684\u7279\u6027\u3002\r\n\r\nApache Groovy provides\u4ea7\u54c1\u5b58\u5728\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eApache Groovy\u63d0\u4f9b\u4e86\u6269\u5c55\u65b9\u6cd5\u6765\u5e2e\u52a9\u521b\u5efa\u4e34\u65f6\u76ee\u5f55\u3002\u5728\u6b64\u4fee\u590d\u4e4b\u524d\uff0cGroovy\u5bf9\u8fd9\u4e9b\u6269\u5c55\u65b9\u6cd5\u7684\u5b9e\u73b0\u4f7f\u7528\u7684\u662f\u4e00\u4e2a\u5df2\u88ab\u53d6\u4ee3\u7684Java JDK\u65b9\u6cd5\u8c03\u7528\uff0c\u5728\u67d0\u4e9b\u4e0a\u4e0b\u6587\u4e2d\uff0c\u8fd9\u79cd\u65b9\u6cd5\u5728\u67d0\u4e9b\u64cd\u4f5c\u7cfb\u7edf\u4e0a\u53ef\u80fd\u4e0d\u5b89\u5168\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Groovy Provides\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Apache Groovy 4.0.0-alpha-1",
      "Apache Apache Groovy \u003e=2.0\uff0c\u003c=2.4.20",
      "Apache Apache Groovy \u003e=2.5.0\uff0c\u003c=2.5.13",
      "Apache Apache Groovy \u003e=3.0.0\uff0c\u003c=3.0.6"
    ]
  },
  "referenceLink": "https://groovy-lang.org/security.html",
  "serverity": "\u4f4e",
  "submitTime": "2020-12-10",
  "title": "Apache Groovy Provides\u8d44\u6e90\u7ba1\u7406\u9519\u8bef\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.