[ GLSA 202003-01 ] Groovy

[GLSA]

Gentoo Linux Security Advisory

Title: Groovy: Arbitrary code execution (GLSA 202003-01)
Severity: normal
Exploitable: remote
Date: 2020-03-07
Bug(s): #605690
ID: 202003-01

Synopsis

A vulnerability within serialization might allow remote attackers
to execute arbitrary code.


Background

A multi-faceted language for the Java platform

Affected Packages

Package: dev-java/groovy
Vulnerable: <= 2.4.5
Architectures: All supported architectures


Description

It was discovered that there was a vulnerability within the Java
serialization/deserialization process.


Impact

An attacker, by crafting a special serialized object, could execute
arbitrary code.


Workaround

There is no known workaround at this time.

Resolution

Gentoo has discontinued support for Groovy. We recommend that users
unmerge Groovy: