Red Hat Security AdvisoryRHSA-2017:2596
rh-maven33-groovy security update
Released 2017-09-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-maven33-groovy-1.8.9-7.19.el6, rh-maven33-groovy-javadoc-1.8.9-7.19.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven33-groovy-1.8.9-7.19.el7, rh-maven33-groovy-javadoc-1.8.9-7.19.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-maven33-groovy-1.8.9-7.19.el6, rh-maven33-groovy-javadoc-1.8.9-7.19.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-maven33-groovy-1.8.9-7.19.el7, rh-maven33-groovy-javadoc-1.8.9-7.19.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-maven33-groovy-1.8.9-7.19.el6, rh-maven33-groovy-javadoc-1.8.9-7.19.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven33-groovy-1.8.9-7.19.el7, rh-maven33-groovy-javadoc-1.8.9-7.19.el7
Fixes 2 records
Priority HIGH 70
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.41032 · Published 2015-08-13 · Partial fix · 2.4.4 CWE-74
Priority MEDIUM 59
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.17239 · Published 2018-01-18 · Partial fix · 2.4.8 CWE-502
