Red Hat Security Advisory: rh-maven33-groovy security update

🔗 CVE IDs covered (2)

📋 Description

🎯 Affected products24

• Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
• Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
• Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
• Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
• Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
• Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
• rh-maven33-groovy-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
• rh-maven33-groovy-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
• rh-maven33-groovy-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
• rh-maven33-groovy-0:1.8.9-7.19.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
• rh-maven33-groovy-0:1.8.9-7.19.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
• rh-maven33-groovy-0:1.8.9-7.19.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
• rh-maven33-groovy-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
• rh-maven33-groovy-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
• rh-maven33-groovy-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
• rh-maven33-groovy-0:1.8.9-7.19.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
• rh-maven33-groovy-0:1.8.9-7.19.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
• rh-maven33-groovy-0:1.8.9-7.19.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
• rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
• rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
• rh-maven33-groovy-javadoc-0:1.8.9-7.19.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
• rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
• rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
• rh-maven33-groovy-javadoc-0:1.8.9-7.19.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java): public class MethodClosure extends Closure { + private Object readResolve() { + throw new UnsupportedOperationException(); + } Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.

🔗 References (5)

• selfhttps://access.redhat.com/errata/RHSA-2017:2596
• externalhttps://access.redhat.com/security/updates/classification/#important
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1243934
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1413466
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2596.json