CVE-2021-41034

{"id": "CVE-2021-41034", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2021-09-29T22:15:07.367", "references": [{"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-924"}]}, {"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-924"}]}], "descriptions": [{"lang": "en", "value": "The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che."}, {"lang": "es", "value": "La compilaci\u00f3n de algunas pilas de lenguaje de Eclipse Che versi\u00f3n 6, incluye una extracci\u00f3n de algunos binarios desde un endpoint HTTP no seguro. Como consecuencia, las compilaciones de dichos stacks son vulnerables a ataques de tipo MITM que permiten la sustituci\u00f3n de los binarios originales por otros arbitrarios. Las pilas implicadas son Java 8 (alpine y centos), Android y PHP. La vulnerabilidad no es explotable en tiempo de ejecuci\u00f3n sino s\u00f3lo cuando se construye el Che"}], "lastModified": "2021-10-07T20:35:06.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:che:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27CF1583-CC8A-408D-977D-5039879B886C", "versionEndExcluding": "7.0.0", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}