Bug#977399: groovy: CVE-2020-17521

[Salvatore Bonaccorso]

Source: groovy
Version: 2.4.20-1
Severity: important
Tags: security upstream
Forwarded: https://issues.apache.org/jira/browse/GROOVY-9824
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for groovy.

CVE-2020-17521[0]:
| Apache Groovy provides extension methods to aid with creating
| temporary directories. Prior to this fix, Groovy's implementation of
| those extension methods was using a now superseded Java JDK method
| call that is potentially not secure on some operating systems in some
| contexts. Users not using the extension methods mentioned in the
| advisory are not affected, but may wish to read the advisory for
| further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13,
| 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14,
| 3.0.7, 4.0.0-alpha-2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-17521
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17521
[1] https://issues.apache.org/jira/browse/GROOVY-9824
[2] https://www.openwall.com/lists/oss-security/2020/12/06/1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore