CVE-2021-41034 Supply chain in Eclipse Che
Attackers can replace binaries with malicious ones during Eclipse Che stack builds via MITM, leading to code execution in the development environment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41034?
CVE-2021-41034 is a high-severity vulnerability in The Eclipse Foundation Eclipse Che, published on 29 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.
Weakness: CWE-924
Which versions are affected by CVE-2021-41034?
It affects 1 product.
Products include Eclipse Che.
How do I fix CVE-2021-41034?
No fix has been published for CVE-2021-41034 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-41034 being exploited?
There is no known exploitation of CVE-2021-41034 in the wild and no public exploit code.
Other vulnerabilities in The Eclipse Foundation Eclipse Che
Sources
Also known as GHSA-cjjm-2hw2-c3jx.