~ / search / GHSA-fg2q-v428-2gph

GHSA-fg2q-v428-2gph

Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS

Source: GitHub Advisory Database (reviewed) High CVE-2019-10248

Packages

EcosystemPackageAffectedFixed in
Maven org.eclipse.vorto:org.eclipse.vorto.core < 0.11.0 0.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.

References

External links from the advisory. They lead to third-party sites.