CVE-2020-17521: 
Java vulnerability analysis and mitigation

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. The vulnerability affects versions 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2 (Groovy Security).

The vulnerability stems from Groovy's use of a deprecated Java JDK method for creating temporary directories that is not secure in certain operating system contexts. This primarily impacts Unix-like systems, and very old versions of Mac OSX and Windows. When Groovy creates temporary directories within the OS temporary directory (which is shared between all users on affected systems), it can lead to security issues (Groovy Security).

If Groovy code writes or stores executable code in the temporary directory, the risk is high and can lead to local privilege escalation. If the code writes sensitive information like API keys or passwords into the temporary directory, the risk is medium as this information may be exposed or modified. The vulnerability only affects users who use Groovy's createTempDir extension methods on impacted operating systems where other users have access to the machine (Groovy Security).

The vulnerability exists due to a race condition whereby the temporary directory creation is not properly checked. This can be exploited on systems where multiple users have access to the shared temporary directory. The risk of exploitation is highest when executable code is stored in these temporary directories (Groovy Security).

Users can mitigate this vulnerability by setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user. This fixes the vulnerability for all operating systems and all Groovy versions. Alternatively, users can upgrade to the fixed versions (2.4.21, 2.5.14, 3.0.7, or 4.0.0-alpha-2) or use the JDK's Files#createTempDirectory method instead of the Groovy extension methods (Groovy Security).

Multiple major software projects were affected by similar vulnerabilities, including Jetty, JUnit4, Google Guava, Apache Ant, and JetBrains Kotlin Compiler, indicating this was a widespread security issue in the Java ecosystem (Groovy Security).