p2 lets touchpoint execute potentially malicious code without warning or trust check
The Eclipse Foundation is a Common Vulnerabilities and Exposures (CVE) Numbering Authority. This issue it used to request and track the progress of the assignment of a CVE for a vulnerability in the project code for an Eclipse open source project.
Basic information
Project name: Equinox p2
Project id: eclipse.equinox
Versions affected: All
Common Weakness Enumeration:
- CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Common Vulnerability Scoring System:
- CVSS v3.1
- Base Score: 5.5
- AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R/CR:M/IR:M/AR:M/MAV:N/MAC:L/MPR:N/MUI:R/MS:U/MC:L/MI:L/MA:L
Summary:
In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.
Links:
Tracking
This section will completed by the project team.
-
We're ready for this issue to be reported to the central authority (i.e., make this public now) -
(when applicable) The GitHub Security Advisory is ready to be published now
Note that for those projects that host their repositories on GitHub, the use of GitHub Security Advisories is recommended but is not required.
This section will be completed by the EMO.
CVE: CVE-2021-41037
-
All required information is provided -
CVE Assigned -
Pushed to Mitre -
Accepted by Mitre