CVE-2021-41033 Supply chain in Eclipse Equinox
Attackers can install malicious plugins via man-in-the-middle attacks on HTTP p2 repositories, compromising the Eclipse installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41033?
CVE-2021-41033 is a high-severity vulnerability in The Eclipse Foundation Eclipse Equinox, published on 13 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by installing plug-ins that may then run malicious code.
Weakness: CWE-300
Which versions are affected by CVE-2021-41033?
It affects 1 product.
Products include Eclipse Equinox.
How do I fix CVE-2021-41033?
No fix has been published for CVE-2021-41033 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-41033 being exploited?
There is no known exploitation of CVE-2021-41033 in the wild and no public exploit code.
Sources
Also known as GHSA-c5fh-3q27-g4r5.