GLSA 201610-01: Groovy: Arbitrary code execution

http://security.gentoo.org/

Severity:	normal
Title:	Groovy: Arbitrary code execution
Date:	10/06/2016
Bugs:	#555470
ID:	201610-01

Synopsis

Groovy is vulnerable to a remote execution of arbitrary code when java serialization is used.

Background

A multi-faceted language for the Java platform

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
dev-java/groovy	< 2.4.5	>= 2.4.5	All supported architectures

Description

Groovy’s MethodClosure class, in runtime/MethodClosure.java, is vulnerable to a crafted serialized object.

Impact

Remote attackers could potentially execute arbitrary code, or cause Denial of Service condition

Workaround

A workaround exists by using a custom security policy file utilizing the standard Java security manager, or do not rely on serialization to communicate remotely.

Resolution

All Groovy users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose ">=dev-java/groovy-2.4.5"

References

CVE-2015-3253

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201610-01.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.