Aller au contenu
Se connecter
Non notée

CVE-2021-41034 The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP…

Description

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.

Produits et versions touchés

Produit Versions touchées Corrigé en
Eclipse Che 7.0 premières → < 7.0 7.0
Eclipse Che 6.0 6.0 → dernières Pas de correctif indiqué

Autres CVE de Eclipse Che

Les 2 CVE de Eclipse Che →
CVE-2019-17633 For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could… Non notée
Suivre cette CVE