Description
The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| The Eclipse Foundation | Eclipse Che | affected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2021-28187 | The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che. |
References
| Link | Providers |
|---|---|
| https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989 |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: eclipse
Published:
Updated: 2024-08-04T02:59:31.177Z
Reserved: 2021-09-13T00:00:00.000Z
Link: CVE-2021-41034
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-09-29T22:15:07.367
Modified: 2024-11-21T06:25:19.343
Link: CVE-2021-41034
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses