https://bugzilla.redhat.com/show_bug.cgi?id=1939630
Bug ID: 1939630
Summary: CVE-2020-27225 eclipse: Help Subsystem does not
authenticate active help requests
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: akurtako(a)redhat.com, andjrobins(a)gmail.com,
dbhole(a)redhat.com, ebaron(a)redhat.com,
eclipse-sig(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, jjohnstn(a)redhat.com,
lef(a)fedoraproject.org, mat.booth(a)redhat.com,
mcermak(a)redhat.com, mprchlik(a)redhat.com,
patrickm(a)redhat.com, rgrunber(a)redhat.com,
vkadlcik(a)redhat.com
Target Milestone: ---
Classification: Other
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does
not authenticate active help requests to the local help web server, allowing an
unauthenticated local attacker to issue active help commands to the associated
Eclipse Platform process or Eclipse Rich Client Platform process.
References:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=569855
--
You are receiving this mail because:
You are on the CC list for the bug.