CVE-2021-41034

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-29 · updated 2026-06-17
Weakness: CWE-924

Description

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.

Affected products

The Eclipse Foundation Eclipse Che: from 6.0.0 before 7.0.0 — fixed in 7.0.0

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Che 7.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41034 or the next vulnerability affects your stack