Potentially compromised builds

ALTO 8.1CVE-2019-10249 · GHSA-rfj2-4g26-7jw5 · Published 06/05/2019 · updated 17/06/2026

In breve

CVE-2019-10249 è una vulnerabilità ALTO (CVSS 8.1) che riguarda org.eclipse.xtend:org.eclipse.xtend.core, org.eclipse.xtext:org.eclipse.xtext, xtend (eclipse).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.65%, superiore al 51.2% delle vulnerabilità.
Correzione: aggiornare a 2.18.0 o successiva.

Package	Affected versions	Patched versions
org.eclipse.xtend:org.eclipse.xtend.core Maven	`< 2.18.0`	`2.18.0`
org.eclipse.xtext:org.eclipse.xtext Maven	`< 2.18.0`	`2.18.0`
xtend eclipse	`< 2.18.0`	`2.18.0`
xtext eclipse	`< 2.18.0`	`2.18.0`

Description

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

NVD description

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

References

nvd.nist.gov/vuln/detail/CVE-2019-10249 · ADVISORY
eclipse/xtext-xtend · WEB
eclipse/xtext-xtend commit 169de2c · WEB
bugs.eclipse.org/bugs/show_bug.cgi · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free