Potentially compromised builds

ÉLEVÉE 8.1CVE-2019-10249 · GHSA-rfj2-4g26-7jw5 · Published 06/05/2019 · updated 17/06/2026

En bref

CVE-2019-10249 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant org.eclipse.xtend:org.eclipse.xtend.core, org.eclipse.xtext:org.eclipse.xtext, xtend (eclipse).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.65%, plus élevée que 51.2% des vulnérabilités.
Correctif : mettre à jour vers 2.18.0 ou plus récent.

Package	Affected versions	Patched versions
org.eclipse.xtend:org.eclipse.xtend.core Maven	`< 2.18.0`	`2.18.0`
org.eclipse.xtext:org.eclipse.xtext Maven	`< 2.18.0`	`2.18.0`
xtend eclipse	`< 2.18.0`	`2.18.0`
xtext eclipse	`< 2.18.0`	`2.18.0`

Description

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

NVD description

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

References

nvd.nist.gov/vuln/detail/CVE-2019-10249 · ADVISORY
eclipse/xtext-xtend · WEB
eclipse/xtext-xtend commit 169de2c · WEB
bugs.eclipse.org/bugs/show_bug.cgi · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free