Red Hat Security Advisory: rh-maven33-groovy security update

Fixed packages 4

Vulnerabilities 2

• Critical 9.8
  CVE-2015-3253 EPSS 41%

  Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy

  The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

  groovy org.codehaus.groovy:groovy org.codehaus.groovy:groovy-all groovy Debian Ubuntu Maven
  Aug 13, 2015
• Critical 9.8
  CVE-2016-6814 EPSS 17%

  Deserialization of Untrusted Data in Groovy

  When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an att…

  org.codehaus.groovy:groovy-all groovy groovy org.codehaus.groovy:groovy Debian Ubuntu Maven
  Jan 18, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1243934
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1413466
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2596.json
• report
  https://access.redhat.com/security/cve/CVE-2015-3253
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-3253
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-3253
• article
  http://seclists.org/oss-sec/2015/q3/121
• report
  https://access.redhat.com/security/cve/CVE-2016-6814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6814
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6814