CVE-2021-41034CWE-924

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint

published September 29, 2021

CVSS
—
EPSS
0%
Percentile
33.8
In the wild
Unconfirmed
What it is

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.8th percentile
Weakness
CWE-924 · Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Published
2021-09-29T21:35Z
EPSS history
Timeline
  • 29 SEP 21:35Z
    The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint
    cvelistv5