Vulnerability · Published Sep 29, 2021 · Assigned by eclipse

CVE-2021-41034

High 8.1

In plain English

A high-severity security flaw in Eclipse Che from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS NVD)8.1High

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.

Affected products (as reported)

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Che	6.0 – before unspecifiedunspecified – before 7.0

Weakness: CWE-924

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989 x_refsource_CONFIRM