PT-2021-4475 · Eclipse · Eclipse Che

Scott Gayou · Published 2021-09-29 · Updated 2021-10-07 · CVE-2021-41034

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Che version 6

Description The issue is related to the build process of some language stacks in Eclipse Che, which pulls binaries from an unsecured HTTP endpoint, making them vulnerable to man-in-the-middle (MITM) attacks. This allows for the replacement of original binaries with arbitrary ones. The affected stacks include Java 8 (alpine and centos), Android, and PHP. The vulnerability can only be exploited during the build process, not at runtime.

Recommendations For Eclipse Che version 6, consider disabling the build process for the affected language stacks until a secure HTTP endpoint is implemented. Restrict access to the unsecured HTTP endpoint to minimize the risk of exploitation. Avoid using the affected stacks (Java 8, Android, and PHP) until the issue is resolved. As a temporary workaround, consider using alternative, secured endpoints for pulling binaries. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-924

Related Identifiers

BDU:2021-05108

CVE-2021-41034

Affected Products

Eclipse Che

References · 8

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41034 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41034 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05108 · Security Note
• https://t.me/cibsecurity/29695 · Telegram Post
• https://t.me/cvenotify/21659 · Telegram Post
• https://t.me/cvenotify/22104 · Telegram Post
• https://t.me/cvenotify/21665 · Telegram Post