CVE-2019-10240: Cleartext Transmission of Sensitive Information in Eclipse hawkBit
Summary
CVE-2019-10240: Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Affects org.eclipse.hawkbit:hawkbit-autoconfigure versions < 0.3.0M2. Fixed in 0.3.0M2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse hawkBit is an open-source software update server that allows the management and deployment of software updates to edge devices. It provides functionality for updating firmware, software, and configuration data on IoT devices. The hawkBit project consists of several Maven packages, including hawkbit-autoconfigure, hawkbit-ui, hawkbit-parent, hawkbit-starters, hawkbit-boot-starter, hawkbit-update-server, hawkbit-boot-starter-mgmt-ui, hawkbit-boot-starter-mgmt-api, hawkbit-boot-starter-dmf-api, and hawkbit-boot-starter-ddi-api.
Vulnerability Detail
The vulnerability in Eclipse hawkBit versions prior to 0.3.0M2 involves the cleartext transmission of sensitive information and the inclusion of functionality from an untrusted control sphere. The Maven build artifacts for the Vaadin based UI were resolved over HTTP instead of HTTPS, making them susceptible to a man-in-the-middle (MITM) attack. This means that any of the dependent artifacts could have been maliciously compromised, potentially resulting in infected build artifacts for hawkBit. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
0.3.0M2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Eclipse hawkBit versions prior to 0.3.0M2 involves the cleartext transmission of sensitive information and the inclusion of functionality from an untrusted control sphere. It is recommended to upgrade to version 0.3.0M2 or later of the affected packages to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.eclipse.hawkbit:hawkbit-autoconfigure →
FAQ
Eclipse hawkBit is an open-source software update server used for managing and deploying software updates to edge devices, including IoT devices.
The vulnerability in Eclipse hawkBit could allow an attacker to compromise the build artifacts of hawkBit, potentially leading to the distribution of infected software updates to edge devices.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, upgrading to version 0.3.0M2 or later of the affected packages resolves this vulnerability.
For more information about this vulnerability, you can refer to the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/04/GHSA-jwqm-c9f2-2cq3/GHSA-jwqm-c9f2-2cq3.json
