Red Hat Security AdvisoryRHSA-2017:2486
groovy security update
Released 2017-08-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) groovy-1.8.9-8.el7_4, groovy-javadoc-1.8.9-8.el7_4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) groovy-1.8.9-8.el7_4, groovy-javadoc-1.8.9-8.el7_4
- Red Hat Enterprise Linux Server Optional (v. 7) groovy-1.8.9-8.el7_4, groovy-javadoc-1.8.9-8.el7_4
- Red Hat Enterprise Linux Workstation Optional (v. 7) groovy-1.8.9-8.el7_4, groovy-javadoc-1.8.9-8.el7_4
Fixes 2 records
Priority HIGH 70
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.41032 · Published 2015-08-13 · Partial fix · 2.4.4 CWE-74
Priority MEDIUM 59
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.17239 · Published 2018-01-18 · Partial fix · 2.4.8 CWE-502
