description: The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.
problem types: CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
affected:
{
product: Eclipse Che
vendor: The Eclipse Foundation
versions:
lessThan: unspecified, status: affected, version: 6.0, versionType: custom
lessThan: 7.0, status: affected, version: unspecified, versionType: custom
}