CVE-2021-41033: Channel Accessible by Non-Endpoint

September 13, 2021 (updated September 24, 2021)

Eclipse Equinox installations can be vulnerable to man-in-the-middle attacks if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by installing plug-ins that may then run malicious code.

References

bugs.eclipse.org/bugs/show_bug.cgi?id=575688
nvd.nist.gov/vuln/detail/CVE-2021-41033

Code Behaviors & Features

Detect and mitigate CVE-2021-41033 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →