CVE-2019-10249 Potentially compromised builds
Attackers could compromise Eclipse Xtext artifacts during HTTP-based builds, potentially leading to code execution in dependent applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10249?
CVE-2019-10249 is a high-severity vulnerability in The Eclipse Foundation Eclipse Xtext, published on 6 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.
Which versions are affected by CVE-2019-10249?
4 open source packages ship an affected version, including org.eclipse.xtext:org.eclipse.xtext and org.eclipse.xtend:org.eclipse.xtend.core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.xtext:org.eclipse.xtext Maven | All versions | 2.18.0 |
org.eclipse.xtext:org.eclipse.xtext Maven | All versions | 2.18.0 |
org.eclipse.xtend:org.eclipse.xtend.core Maven | All versions | 2.18.0 |
org.eclipse.xtend:org.eclipse.xtend.core Maven | All versions | 2.18.0 |
Products include Eclipse Xtend, Eclipse Xtext.
How do I fix CVE-2019-10249?
Upgrade org.eclipse.xtext:org.eclipse.xtext to 2.18.0 or later.
Is CVE-2019-10249 being exploited?
There is no known exploitation of CVE-2019-10249 in the wild and no public exploit code.
Sources
Also known as GHSA-rfj2-4g26-7jw5.