Description
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Eclipse Foundation Eclipse IDE
Default version status: unaffected
0 to < 4.29affected
Eclipse Foundation Eclipse IDE
Default version status: unaffected
0 to < 2023-09affected
Eclipse Foundation org.eclipse.core.runtime
Default version status: unaffected
0 to < 3.29.0affected
Eclipse Foundation org.eclipse.pde
Default version status: unaffected
0 to ≤ 3.13.2400affected
References
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 ↗
- https://github.com/eclipse-pde/eclipse.pde/pull/632/ ↗
- https://github.com/eclipse-pde/eclipse.pde/pull/667/ ↗
- https://github.com/eclipse-platform/eclipse.platform/pull/761 ↗
- https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45 ↗
- https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd ↗
- https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec ↗
- https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d ↗
- https://github.com/eclipse-emf/org.eclipse.emf/issues/10 ↗
- https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba ↗
- https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b ↗