CVE-2021-41037: Critical severity eclipse equinox p2 vulnerability
In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-41037?
CVE-2021-41037 is a vulnerability in Eclipse p2 that allows installable units to alter the Eclipse Platform installation and the local machine during installation.
How does CVE-2021-41037 affect Eclipse Equinox P2?
CVE-2021-41037 affects Eclipse Equinox P2 by allowing installable units to modify the Eclipse Platform installation and the local machine through touchpoints during installation.
What is the severity of CVE-2021-41037?
CVE-2021-41037 has a severity level of high, with a CVSS severity score of 8.
How can CVE-2021-41037 be exploited?
CVE-2021-41037 can be exploited by malicious installable units that are able to execute touchpoints during Eclipse p2 installation.
Is there a fix for CVE-2021-41037?
Yes, updates and patches are available to address and fix the vulnerability.