CVE-2019-10240 Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit
Attackers can compromise hawkBit builds via MITM attacks on insecure Maven dependencies, leading to malicious code execution in deployed instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10240?
CVE-2019-10240 is a high-severity vulnerability in The Eclipse Foundation Eclipse hawkBit, published on 3 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
Which versions are affected by CVE-2019-10240?
20 open source packages ship an affected version, including org.eclipse.hawkbit:hawkbit-autoconfigure, org.eclipse.hawkbit:hawkbit-boot-starter and org.eclipse.hawkbit:hawkbit-boot-starter-ddi-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.hawkbit:hawkbit-autoconfigure Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-autoconfigure Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter-ddi-api Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter-ddi-api Maven | All versions | 0.3.0M2 |
14 more packages
org.eclipse.hawkbit:hawkbit-boot-starter-dmf-api Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter-dmf-api Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-api Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-api Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-ui Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-ui Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-parent Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-parent Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-starters Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-starters Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-ui Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-ui Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-update-server Maven | All versions | 0.3.0M2 |
org.eclipse.hawkbit:hawkbit-update-server Maven | All versions | 0.3.0M2 |
Products include Eclipse Hawkbit.
How do I fix CVE-2019-10240?
Upgrade org.eclipse.hawkbit:hawkbit-autoconfigure to 0.3.0M2 or later.
Is CVE-2019-10240 being exploited?
There is no known exploitation of CVE-2019-10240 in the wild and no public exploit code.
Other vulnerabilities in The Eclipse Foundation Eclipse hawkBit
Sources
Also known as GHSA-jwqm-c9f2-2cq3.