Summary
It was discovered that Apache Groovy incorrectly handled
serialization mechanisms. An attacker could possibly use this issue
to execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | groovy2 | 2.4.5-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.8CVE-2016-6814 EPSS 17%
Deserialization of Untrusted Data in Groovy
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an att…
References
-
report
https://ubuntu.com/security/CVE-2016-6814