Vulnerability Description
The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Che | >= 6.0.0, < 7.0.0 |
Related Weaknesses (CWE)
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989Vendor Advisory
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989Vendor Advisory
FAQ
What is CVE-2021-41034?
CVE-2021-41034 is a vulnerability with a CVSS score of 8.1 (HIGH). The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks tha...
How severe is CVE-2021-41034?
CVE-2021-41034 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-41034?
Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Che.