StackRadarChart IndexLive demo

CVE-2020-17521

Medium

Advisory

Published 9 Dec 2020In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.011; 63rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 28; of 17,781 indexed, latest versions
Container images: 26; deployed by those charts
Fix available: 2 of 2; affected packages

Information Disclosure in Apache Groovy

Carried by container images the latest versions of 28 of 17,781 indexed charts deploy, on 26 images.

Affected package	Affected versions	Fixed in	Images
groovy-allmaven	2.2.2, 2.4.4, 2.4.8, 2.4.11+3 more	2.4.21	20
groovymaven	2.4.6-indy, 2.4.7, 2.4.15, 2.5.5+3 more	2.4.21, 2.5.14, 3.0.7	8

OSV records: GHSA-rcjj-h6gh-jf3r

Charts affected

28 by stars

Chart

Latest

Affected images

Radar Score

microcksmicrocks

0.8.0-helm-3.kube-1.17

1 of 5 See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
microcks/microcks :0.8.0	e3a3e0c67b09	groovy-all@2.4.15	2.4.21

Open the chart page →

10,732

hivebigdata-charts

1 of 1 See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
5200710/hive :3.1.3-postgresql-metastore	e34ab066d2ed	groovy-all@2.4.11	2.4.21

Open the chart page →

7,166

hivedmwm-bigdata

2 of 5 See more

hive dmwm-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
bde2020/hive :2.3.2-postgresql-metastore	620267768985	groovy-all@2.4.4	2.4.21
gradiant/hive :2.3.2-postgresql-metastore	aae4f8a21f8b	groovy-all@2.4.4	2.4.21

Open the chart page →

20,837

hive-metastoreheva-helm-charts

1 of 2 See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
sslhep/hive-metastore :3.1.3	9e80af083079	groovy-all@2.4.11	2.4.21

Open the chart page →

7,335

skywalkingkubesphere-test

1 of 4 See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	groovy@3.0.3	3.0.7

Open the chart page →

18,042

hive-metastoreslamdev

1 of 2 See more

hive-metastore slamdev 0.0.5

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
slamdev/apache-hive :2.3.9-2.10.1	b4b029c9b15f	groovy-all@2.4.4	2.4.21

Open the chart page →

8,198

soarv113assist-iot-cybersecurity-monitoring-soar

1 of 5 See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
assistiot/cybersecurity-monitoring_ir-thv :latest	c8b6c7eaa0cd	groovy@2.5.7-indy	2.5.14

Open the chart page →

17,896

distributed-jmetercloudnativeapp

1 of 1 See more

distributed-jmeter cloudnativeapp 1.0.1

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
pedrocesarti/jmeter-docker :3.3	14851f144f57	groovy-all@2.4.12	2.4.21

Open the chart page →

4,532

hive-metastoredmwm-bigdata

1 of 2 See more

hive-metastore dmwm-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
bde2020/hive :2.3.2-postgresql-metastore	620267768985	groovy-all@2.4.4	2.4.21

Open the chart page →

6,882

spinnakerdwardu-helm-charts

1 of 2 See more

spinnaker dwardu-helm-charts 2.2.6

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
gcr.io/spinnaker-marketplace/halyard :1.32.0	0ee5f968d2ab	groovy@2.5.9	2.5.14

Open the chart page →

8,752

stormgresearch

1 of 3 See more

storm gresearch 1.2.0

1 of the 3 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
library/storm :2.4.0	bd5d420506d6	groovy-all@2.4.4	2.4.21

Open the chart page →

6,165

rundeckcloudnativeapp

1 of 2 See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
rundeck/rundeck :3.0.16	b13e8059ad72	groovy@2.4.15 groovy-all@2.4.15	2.4.21 2.4.21

Open the chart page →

23,665

rundeckdwardu-helm-charts

1 of 2 See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
rundeck/rundeck :3.2.7	4d64fe56f767	groovy@2.4.15 groovy-all@2.4.15	2.4.21 2.4.21

Open the chart page →

19,802

geonetwork-k8sgeonetwork-k8s

1 of 5 See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
jingking/geonetwork-hnap :4.2.8	43e74ab234e1	groovy@2.5.5	2.5.14

Open the chart page →

34,754

hivegradiant-bigdata

2 of 5 See more

hive gradiant-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
bde2020/hive :2.3.2-postgresql-metastore	620267768985	groovy-all@2.4.4	2.4.21
gradiant/hive :2.3.2-postgresql-metastore	aae4f8a21f8b	groovy-all@2.4.4	2.4.21

Open the chart page →

20,837

hive-metastoregradiant-bigdata

1 of 2 See more

hive-metastore gradiant-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
bde2020/hive :2.3.2-postgresql-metastore	620267768985	groovy-all@2.4.4	2.4.21

Open the chart page →

6,882

ibm-microclimateibm-charts

1 of 8 See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
ibmcom/microclimate-portal :latest	ed5505e5c7ec	groovy-all@2.4.12	2.4.21

Open the chart page →

57,669

jenkinsjenkins-x

1 of 2 See more

jenkins jenkins-x 0.10.38

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
jenkinsci/jenkins :2.67	a1f33f004659	groovy-all@2.4.11	2.4.21

Open the chart page →

10,682

nexusjenkins-x

1 of 1 See more

nexus jenkins-x 0.1.37

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	groovy-all@2.4.17	2.4.21

Open the chart page →

12,856

elasticsearch2ncsa

1 of 2 See more

elasticsearch2 ncsa 0.2.2

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
library/elasticsearch :2.4.6	41ed3a1a16b6	groovy@2.4.6-indy	2.4.21

Open the chart page →

4,911

smsf-configurationopenshift

1 of 1 See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
gurolakman/smsf-configuration :1.0.4	9abb3882bcbd	groovy-all@2.2.2	2.4.21

Open the chart page →

13,607

smsf-momtopenshift

1 of 1 See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	groovy-all@2.2.2	2.4.21

Open the chart page →

13,568

smsf-registrationopenshift

1 of 1 See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
gurolakman/smsf-registration :1.0.4	b22e746edd5d	groovy-all@2.2.2	2.4.21

Open the chart page →

13,551

ussigw-configurationopenshift

1 of 1 See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
gurolakman/ussigw-configuration :1.0.4	bf18525c5ad9	groovy-all@2.2.2	2.4.21

Open the chart page →

13,455

ussigw-coreopenshift

1 of 1 See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
gurolakman/ussigw-core :1.0.4	8739565c3ea2	groovy-all@2.2.2	2.4.21

Open the chart page →

13,100

sonatype-nexus3simcube

1 of 2 See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
sonatype/nexus3 :3.58.1	586060431b64	groovy-all@2.4.17	2.4.21

Open the chart page →

4,946

streamastreama

1 of 2 See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
just1not2/streama :1.10.4	8a2305192dec	groovy@2.4.7	2.4.21

Open the chart page →

8,554

is-pattern-1wso2is-pattern1

1 of 2 See more

is-pattern-1 wso2is-pattern1 5.11.0

1 of the 2 container images this version deploys carry CVE-2020-17521.

Container image	Digest	Package	Fixed in
massimolauri/wso2is :5.11.0-centos	e08abf0ce767	groovy-all@2.4.8	2.4.21

Open the chart page →

6,213

Container images carrying it

26 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
bde2020/hive :2.3.2-postgresql-metastore	620267768985	groovy-all@2.4.4	2.4.21	4
gradiant/hive :2.3.2-postgresql-metastore	aae4f8a21f8b	groovy-all@2.4.4	2.4.21	2
5200710/hive :3.1.3-postgresql-metastore	e34ab066d2ed	groovy-all@2.4.11	2.4.21	1
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	groovy@3.0.3	3.0.7	1
assistiot/cybersecurity-monitoring_ir-thv :latest	c8b6c7eaa0cd	groovy@2.5.7-indy	2.5.14	1
gurolakman/smsf-configuration :1.0.4	9abb3882bcbd	groovy-all@2.2.2	2.4.21	1
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	groovy-all@2.2.2	2.4.21	1
gurolakman/smsf-registration :1.0.4	b22e746edd5d	groovy-all@2.2.2	2.4.21	1
gurolakman/ussigw-configuration :1.0.4	bf18525c5ad9	groovy-all@2.2.2	2.4.21	1
gurolakman/ussigw-core :1.0.4	8739565c3ea2	groovy-all@2.2.2	2.4.21	1
ibmcom/microclimate-portal :latest	ed5505e5c7ec	groovy-all@2.4.12	2.4.21	1
jenkinsci/jenkins :2.67	a1f33f004659	groovy-all@2.4.11	2.4.21	1
jingking/geonetwork-hnap :4.2.8	43e74ab234e1	groovy@2.5.5	2.5.14	1
just1not2/streama :1.10.4	8a2305192dec	groovy@2.4.7	2.4.21	1
library/elasticsearch :2.4.6	41ed3a1a16b6	groovy@2.4.6-indy	2.4.21	1
library/storm :2.4.0	bd5d420506d6	groovy-all@2.4.4	2.4.21	1
massimolauri/wso2is :5.11.0-centos	e08abf0ce767	groovy-all@2.4.8	2.4.21	1
microcks/microcks :0.8.0	e3a3e0c67b09	groovy-all@2.4.15	2.4.21	1
pedrocesarti/jmeter-docker :3.3	14851f144f57	groovy-all@2.4.12	2.4.21	1
rundeck/rundeck :3.2.7	4d64fe56f767	groovy@2.4.15 groovy-all@2.4.15	2.4.21 2.4.21	1
rundeck/rundeck :3.0.16	b13e8059ad72	groovy@2.4.15 groovy-all@2.4.15	2.4.21 2.4.21	1
slamdev/apache-hive :2.3.9-2.10.1	b4b029c9b15f	groovy-all@2.4.4	2.4.21	1
sonatype/nexus3 :3.58.1	586060431b64	groovy-all@2.4.17	2.4.21	1
sslhep/hive-metastore :3.1.3	9e80af083079	groovy-all@2.4.11	2.4.21	1
gcr.io/spinnaker-marketplace/halyard :1.32.0	0ee5f968d2ab	groovy@2.5.9	2.5.14	1
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	groovy-all@2.4.17	2.4.21	1