158 lines
14 KiB
XML
158 lines
14 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for eclipse is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2022-1759</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2022-07-22</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2022-07-22</InitialReleaseDate>
|
|
<CurrentReleaseDate>2022-07-22</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2022-07-22</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">eclipse security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for eclipse is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">The Eclipse platform is designed for building integrated development environments (IDEs), server-side applications, desktop applications, and everything in between.
|
|
|
|
Security Fix(es):
|
|
|
|
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.(CVE-2020-27225)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for eclipse is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
|
|
|
|
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">eclipse</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1759</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2020-27225</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2020-27225</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">openEuler-20.03-LTS-SP3</FullProductName>
|
|
<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="eclipse-platform-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-platform-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-equinox-osgi-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-equinox-osgi-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-pde-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-pde-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-swt-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-swt-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debugsource-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-debugsource-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debuginfo-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-debuginfo-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-tests-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-tests-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-contributor-tools-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-contributor-tools-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-equinox-osgi-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-equinox-osgi-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-pde-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-pde-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-platform-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-platform-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-contributor-tools-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-contributor-tools-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debuginfo-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-debuginfo-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debugsource-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-debugsource-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-swt-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-swt-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-tests-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-tests-4.11-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debugsource-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-debugsource-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-platform-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-platform-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-equinox-osgi-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-equinox-osgi-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-swt-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-swt-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-tests-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-tests-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debuginfo-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-debuginfo-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-pde-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-pde-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-contributor-tools-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-contributor-tools-4.11-5.oe2203.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="noarch">
|
|
<FullProductName ProductID="eclipse-p2-discovery-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-p2-discovery-4.11-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-jdt-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-jdt-4.11-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-jdt-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-jdt-4.11-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-p2-discovery-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-p2-discovery-4.11-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-p2-discovery-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-p2-discovery-4.11-5.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-jdt-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-jdt-4.11-5.oe2203.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="eclipse-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-4.11-4.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-4.11-4.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-4.11-5.oe2203.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="eclipse-debuginfo-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-debuginfo-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-pde-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-pde-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-equinox-osgi-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-equinox-osgi-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-swt-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-swt-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-tests-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-tests-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-contributor-tools-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-contributor-tools-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debugsource-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-debugsource-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-platform-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">eclipse-platform-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debuginfo-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-debuginfo-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-pde-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-pde-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-swt-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-swt-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-equinox-osgi-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-equinox-osgi-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debugsource-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-debugsource-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-contributor-tools-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-contributor-tools-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-tests-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-tests-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-platform-4.11-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">eclipse-platform-4.11-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-swt-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-swt-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debugsource-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-debugsource-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-pde-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-pde-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-debuginfo-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-debuginfo-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-contributor-tools-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-contributor-tools-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-equinox-osgi-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-equinox-osgi-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-platform-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-platform-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="eclipse-tests-4.11-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">eclipse-tests-4.11-5.oe2203.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2022-07-22</ReleaseDate>
|
|
<CVE>CVE-2020-27225</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
|
|
<ProductID>openEuler-22.03-LTS</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.8</BaseScore>
|
|
<Vector>AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>eclipse security update</Description>
|
|
<DATE>2022-07-22</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1759</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |