PatchTheCVECVE-2020-17521: Apache Groovy provides extension methods to aid with creating temporary directories
40
This month
MEDIUM 5.5WATCHLISTUPGRADEMITIGATEDOWNGRADE
CVE-2020-17521 is a medium-severity flaw (CVSS 5.5) affecting groovy, snapcenter, agile engineering data management. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.0% (top 36%) |
| CISA exploited list | No |
| Published | 2020-12-07 |
| Last modified | 2026-10-08 |
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
apache groovy UPGRADE
Affected: >= 2.0.0 and <= 2.4.20 · >= 2.5.0 and <= 2.5.13 · >= 3.0.0 and <= 3.0.6 · 4.0.0 alpha1
Fixed in: newer than 3.0.6
Safe to downgrade to: a release before 2.0.0
1. Check installed version
apt-cache policy groovy || rpm -q groovy || groovy --version
2. UPGRADE to newer than 3.0.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade groovy
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade groovy
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)
apt-cache madison groovy
sudo apt install groovy=<VERSION_BEFORE_2.0.0>
sudo apt-mark hold groovy
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list groovy
sudo dnf downgrade groovy-<VERSION_BEFORE_2.0.0>
sudo dnf versionlock add groovy
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
netapp snapcenter MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy snapcenter || rpm -q snapcenter || snapcenter --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
oracle agile engineering data management DOWNGRADE
Affected: 6.2.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.2.1.0
1. Check installed version
apt-cache policy agile-engineering-data-management || rpm -q agile-engineering-data-management || agile-engineering-data-management --version
2. No fixed release: DOWNGRADE to a release before 6.2.1.0 (Debian / Ubuntu)
apt-cache madison agile-engineering-data-management
sudo apt install agile-engineering-data-management=<VERSION_BEFORE_6.2.1.0>
sudo apt-mark hold agile-engineering-data-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list agile-engineering-data-management
sudo dnf downgrade agile-engineering-data-management-<VERSION_BEFORE_6.2.1.0>
sudo dnf versionlock add agile-engineering-data-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle agile plm mcad connector DOWNGRADE
Affected: 3.4 · 3.6
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.4
1. Check installed version
apt-cache policy agile-plm-mcad-connector || rpm -q agile-plm-mcad-connector || agile-plm-mcad-connector --version
2. No fixed release: DOWNGRADE to a release before 3.4 (Debian / Ubuntu)
apt-cache madison agile-plm-mcad-connector
sudo apt install agile-plm-mcad-connector=<VERSION_BEFORE_3.4>
sudo apt-mark hold agile-plm-mcad-connector
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list agile-plm-mcad-connector
sudo dnf downgrade agile-plm-mcad-connector-<VERSION_BEFORE_3.4>
sudo dnf versionlock add agile-plm-mcad-connector
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle agile product lifecycle management DOWNGRADE
Affected: 9.3.3 · 9.3.6
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.3.3
1. Check installed version
apt-cache policy agile-product-lifecycle-management || rpm -q agile-product-lifecycle-management || agile-product-lifecycle-management --version
2. No fixed release: DOWNGRADE to a release before 9.3.3 (Debian / Ubuntu)
apt-cache madison agile-product-lifecycle-management
sudo apt install agile-product-lifecycle-management=<VERSION_BEFORE_9.3.3>
sudo apt-mark hold agile-product-lifecycle-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list agile-product-lifecycle-management
sudo dnf downgrade agile-product-lifecycle-management-<VERSION_BEFORE_9.3.3>
sudo dnf versionlock add agile-product-lifecycle-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle business process management suite DOWNGRADE
Affected: 12.2.1.3.0 · 12.2.1.4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 12.2.1.3.0
1. Check installed version
apt-cache policy business-process-management-suite || rpm -q business-process-management-suite || business-process-management-suite --version
2. No fixed release: DOWNGRADE to a release before 12.2.1.3.0 (Debian / Ubuntu)
apt-cache madison business-process-management-suite
sudo apt install business-process-management-suite=<VERSION_BEFORE_12.2.1.3.0>
sudo apt-mark hold business-process-management-suite
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list business-process-management-suite
sudo dnf downgrade business-process-management-suite-<VERSION_BEFORE_12.2.1.3.0>
sudo dnf versionlock add business-process-management-suite
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-17521?
groovy: upgrade to newer than 3.0.6; snapcenter: mitigate or apply the listed mitigation; agile engineering data management: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-17521 being exploited?
CVE-2020-17521 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-17521 affect?
CVE-2020-17521 affects groovy, snapcenter, agile engineering data management. Severity is medium (CVSS 5.5). Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on som
How urgent is CVE-2020-17521?
Priority 40/100. On your watchlist
Software pages
Related CVEs
- CVE-2019-1003033 HIGH 8.8 UPGRADE A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudso
- CVE-2019-1003006 HIGH 8.8 UPGRADE A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins
- CVE-2016-6814 CRITICAL 9.8 UPGRADE MITIGATE When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2
- CVE-2015-3253 CRITICAL 9.8 DOWNGRADE DOWNGRADE The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attac