Oracle Linux 7 : groovy (ELSA-2017-2486)

High Nessus Plugin ID 102570


The remote Oracle Linux host is missing one or more security updates.


From Red Hat Security Advisory 2017:2486 :

An update for groovy is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby, and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java.

Security Fix(es) :

* It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2016-6814)


Update the affected groovy packages.

See Also

Plugin Details

Severity: High

ID: 102570

File Name: oraclelinux_ELSA-2017-2486.nasl

Version: $Revision: 3.3 $

Type: local

Agent: unix

Published: 2017/08/18

Modified: 2018/01/05

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND


Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:groovy, p-cpe:/a:oracle:linux:groovy-javadoc, cpe:/o:oracle:linux:7

Required KB Items: Host/local_checks_enabled, Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/08/17

Reference Information

CVE: CVE-2015-3253, CVE-2016-6814

OSVDB: 124881

RHSA: 2017:2486