Man-in-the-Middle Vulnerability in Eclipse Che by Eclipse Foundation

CVE-2021-41034

What is CVE-2021-41034?

Eclipse Che version 6 contains a vulnerability where certain language stacks pull binaries from an unsecured HTTP endpoint. This flaw exposes the build process to Man-in-the-Middle (MITM) attacks, enabling an attacker to intercept and replace original binaries with malicious ones during the build phase. Affected stacks include Java 8 (alpine and centos), Android, and PHP. Although the vulnerability does not pose a risk during runtime, it is essential to address this issue during the build process to mitigate potential security threats.

References