Medium severity5.5NVD Advisory· Published Dec 7, 2020· Updated Jun 17, 2026

CVE-2020-17521

Description

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.codehaus.groovy:groovyMaven	>= 2.0.0, < 2.4.21	2.4.21
org.codehaus.groovy:groovyMaven	>= 2.5.0, < 2.5.14	2.5.14
org.codehaus.groovy:groovyMaven	>= 3.0.0, < 3.0.7	3.0.7
org.codehaus.groovy:groovy-allMaven	>= 2.0.0, < 2.4.21	2.4.21
org.codehaus.groovy:groovy-allMaven	>= 2.5.0, < 2.5.14	2.5.14
org.codehaus.groovy:groovy-allMaven	>= 3.0.0, < 3.0.7	3.0.7

Affected products

Apache/Atlas
cpe:2.3:a:apache:atlas:2.1.0:-:*:*:*:*:*:*
Apache/Groovy2 versions
cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*range: >=2.0.0,<=2.4.20
- cpe:2.3:a:apache:groovy:4.0.0:alpha1:*:*:*:*:*:*
NetApp/Snapcenter
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
Oracle Corporation/Agile Engineering Data Management
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*
Oracle Corporation/Agile Plm2 versions
cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Oracle Corporation/Agile Plm Mcad Connector2 versions
cpe:2.3:a:oracle:agile_plm_mcad_connector:3.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:agile_plm_mcad_connector:3.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*
Oracle Corporation/Business Process Management Suite2 versions
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Brm Elastic Charging Engine2 versions
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*
Oracle Corporation/Communications Diameter Signaling Router
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4.0.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Evolved Communications Application Server
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
Oracle Corporation/Communications Services Gatekeeper3 versions
cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
Oracle Corporation/Healthcare Data Repository
cpe:2.3:a:oracle:healthcare_data_repository:7.0.2:*:*:*:*:*:*:*
Oracle Corporation/Hospitality Opera 5
cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*
Oracle Corporation/Ilearning2 versions
cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:*
Oracle Corporation/Insurance Policy Administration
cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*
Range: >=11.0,<=11.3.1
Oracle Corporation/Jd Edwards Enterpriseone Orchestrator
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.6.0:*:*:*:*:*:*:*
Oracle Corporation/Primavera Gateway
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
Range: >=17.12.0,<=17.12.10
Oracle Corporation/Primavera Unifier6 versions
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*range: >=17.7,<=17.12
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
Oracle Corporation/Retail Bulk Data Integration2 versions
cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
Oracle Corporation/Retail Store Inventory Management3 versions
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.10:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.5:*:*:*:*:*:*:*
ghsa-coords5 versions
pkg:maven/org.codehaus.groovy/groovy pkg:maven/org.codehaus.groovy/groovy-all pkg:rpm/opensuse/groovy&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/groovy&distro=openSUSE%20Tumbleweed pkg:rpm/suse/groovy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2
>= 2.0.0, < 2.4.21+ 4 more
- (no CPE)range: >= 2.0.0, < 2.4.21
- (no CPE)range: >= 2.0.0, < 2.4.21
- (no CPE)range: < 2.4.21-lp152.2.3.2
- (no CPE)range: < 2.4.21-2.3
- (no CPE)range: < 2.4.21-3.3.2
Apache Software Foundation/Apache Groovyv5
Range: 2.0 to 2.4.20

Patches

Vulnerability mechanics

References

www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-rcjj-h6gh-jf3rghsaADVISORY
groovy-lang.org/security.htmlnvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-17521ghsaADVISORY
security.netapp.com/advisory/ntap-20201218-0006/nvdThird Party Advisory
github.com/apache/groovy/commit/bcbe5c4c76db83736166530647c024ac1e47ef28ghsaWEB
github.com/apache/groovy/pull/1425ghsaWEB
lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3EghsaWEB
lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3EghsaWEB
lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3EghsaWEB
security.netapp.com/advisory/ntap-20201218-0006ghsaWEB
lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3Envd
lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3Envd
lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000