Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 7 enterprise_linux:7::client | groovy | 0:1.8.9-8.el7_4 |
| Red Hat · RHEL 7 enterprise_linux:7::client | groovy-javadoc | 0:1.8.9-8.el7_4 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | groovy | 0:1.8.9-8.el7_4 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | groovy-javadoc | 0:1.8.9-8.el7_4 |
| Red Hat · RHEL 7 enterprise_linux:7::server | groovy | 0:1.8.9-8.el7_4 |
| Red Hat · RHEL 7 enterprise_linux:7::server | groovy-javadoc | 0:1.8.9-8.el7_4 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | groovy | 0:1.8.9-8.el7_4 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | groovy-javadoc | 0:1.8.9-8.el7_4 |
Vulnerabilities 2
-
Critical 9.8CVE-2015-3253 EPSS 41%
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
-
Critical 9.8CVE-2016-6814 EPSS 17%
Deserialization of Untrusted Data in Groovy
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an att…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1413466
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2486.json
-
report
https://access.redhat.com/security/cve/CVE-2015-3253
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1243934
-
advisory
https://www.cve.org/CVERecord?id=CVE-2015-3253
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-3253
-
article
http://seclists.org/oss-sec/2015/q3/121
-
report
https://access.redhat.com/security/cve/CVE-2016-6814
-
advisory
https://www.cve.org/CVERecord?id=CVE-2016-6814
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-6814