UBUNTU-CVE-2019-10753

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2019-10753
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-10753.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-10753
Upstream
Published
2019-09-05T20:15:00Z
Modified
2025-10-24T04:47:36Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • Ubuntu - low
Summary
[none]
Details

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. Note: In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.

References

Affected packages

Ubuntu:16.04:LTS

eclipse-wtp

Package

Name
eclipse-wtp
Purl
pkg:deb/ubuntu/eclipse-wtp@3.6.3-1?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.6.3-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "3.6.3-1",
            "binary_name": "eclipse-wtp"
        },
        {
            "binary_version": "3.6.3-1",
            "binary_name": "eclipse-wtp-servertools"
        },
        {
            "binary_version": "3.6.3-1",
            "binary_name": "eclipse-wtp-webtools"
        },
        {
            "binary_version": "3.6.3-1",
            "binary_name": "eclipse-wtp-ws"
        },
        {
            "binary_version": "3.6.3-1",
            "binary_name": "eclipse-wtp-xmltools"
        },
        {
            "binary_version": "3.6.3-1",
            "binary_name": "eclipse-wtp-xsl"
        },
        {
            "binary_version": "3.6.3-1",
            "binary_name": "w3c-xsd-xslt"
        }
    ]
}

Ubuntu:18.04:LTS

eclipse-wtp

Package

Name
eclipse-wtp
Purl
pkg:deb/ubuntu/eclipse-wtp@3.6.3-3?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.6.3-3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "3.6.3-3",
            "binary_name": "eclipse-wtp"
        },
        {
            "binary_version": "3.6.3-3",
            "binary_name": "eclipse-wtp-servertools"
        },
        {
            "binary_version": "3.6.3-3",
            "binary_name": "eclipse-wtp-webtools"
        },
        {
            "binary_version": "3.6.3-3",
            "binary_name": "eclipse-wtp-ws"
        },
        {
            "binary_version": "3.6.3-3",
            "binary_name": "eclipse-wtp-xmltools"
        },
        {
            "binary_version": "3.6.3-3",
            "binary_name": "eclipse-wtp-xsl"
        },
        {
            "binary_version": "3.6.3-3",
            "binary_name": "w3c-xsd-xslt"
        }
    ]
}

Ubuntu:22.04:LTS

eclipse-wtp

Package

Name
eclipse-wtp
Purl
pkg:deb/ubuntu/eclipse-wtp@3.18-5?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.18-5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.1.201+eclipse3.18-5",
            "binary_name": "libeclipse-jem-util-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-core-java"
        },
        {
            "binary_version": "1.2.600+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-emf-java"
        },
        {
            "binary_version": "1.2.101+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-emfworkbench-integration-java"
        },
        {
            "binary_version": "1.0.400+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-environment-java"
        },
        {
            "binary_version": "1.2.201+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-frameworks-java"
        },
        {
            "binary_version": "1.2.400+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-frameworks-ui-java"
        },
        {
            "binary_version": "1.4.400+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-project-facet-core-java"
        },
        {
            "binary_version": "1.1.700+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-ui-java"
        },
        {
            "binary_version": "1.2.300+eclipse3.18-5",
            "binary_name": "libeclipse-wst-common-uriresolver-java"
        },
        {
            "binary_version": "1.2.400+eclipse3.18-5",
            "binary_name": "libeclipse-wst-sse-core-java"
        },
        {
            "binary_version": "1.7.0+eclipse3.18-5",
            "binary_name": "libeclipse-wst-sse-ui-java"
        },
        {
            "binary_version": "1.2.800+eclipse3.18-5",
            "binary_name": "libeclipse-wst-validation-java"
        },
        {
            "binary_version": "1.2.600+eclipse3.18-5",
            "binary_name": "libeclipse-wst-validation-ui-java"
        },
        {
            "binary_version": "1.2.200+eclipse3.18-5",
            "binary_name": "libeclipse-wst-xml-core-java"
        },
        {
            "binary_version": "1.2.400+eclipse3.18-5",
            "binary_name": "libeclipse-wst-xml-ui-java"
        },
        {
            "binary_version": "1.2.0+eclipse3.18-5",
            "binary_name": "libeclipse-wst-xsd-core-java"
        }
    ]
}

Ubuntu:24.04:LTS

eclipse-wtp

Package

Name
eclipse-wtp
Purl
pkg:deb/ubuntu/eclipse-wtp@3.18-6?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.18-6

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.1.201+eclipse3.18-6",
            "binary_name": "libeclipse-jem-util-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-core-java"
        },
        {
            "binary_version": "1.2.600+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-emf-java"
        },
        {
            "binary_version": "1.2.101+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-emfworkbench-integration-java"
        },
        {
            "binary_version": "1.0.400+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-environment-java"
        },
        {
            "binary_version": "1.2.201+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-frameworks-java"
        },
        {
            "binary_version": "1.2.400+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-frameworks-ui-java"
        },
        {
            "binary_version": "1.4.400+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-project-facet-core-java"
        },
        {
            "binary_version": "1.1.700+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-ui-java"
        },
        {
            "binary_version": "1.2.300+eclipse3.18-6",
            "binary_name": "libeclipse-wst-common-uriresolver-java"
        },
        {
            "binary_version": "1.2.400+eclipse3.18-6",
            "binary_name": "libeclipse-wst-sse-core-java"
        },
        {
            "binary_version": "1.7.0+eclipse3.18-6",
            "binary_name": "libeclipse-wst-sse-ui-java"
        },
        {
            "binary_version": "1.2.800+eclipse3.18-6",
            "binary_name": "libeclipse-wst-validation-java"
        },
        {
            "binary_version": "1.2.600+eclipse3.18-6",
            "binary_name": "libeclipse-wst-validation-ui-java"
        },
        {
            "binary_version": "1.2.200+eclipse3.18-6",
            "binary_name": "libeclipse-wst-xml-core-java"
        },
        {
            "binary_version": "1.2.400+eclipse3.18-6",
            "binary_name": "libeclipse-wst-xml-ui-java"
        },
        {
            "binary_version": "1.2.0+eclipse3.18-6",
            "binary_name": "libeclipse-wst-xsd-core-java"
        }
    ]
}

Ubuntu:25.04

eclipse-wtp

Package

Name
eclipse-wtp
Purl
pkg:deb/ubuntu/eclipse-wtp@3.35-1?arch=source&distro=plucky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.18-6
3.35-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.2.100+eclipse3.35-1",
            "binary_name": "libeclipse-jem-util-java"
        },
        {
            "binary_version": "1.4.100+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-core-java"
        },
        {
            "binary_version": "1.2.700+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-emf-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-emfworkbench-integration-java"
        },
        {
            "binary_version": "1.1.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-environment-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-frameworks-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-frameworks-ui-java"
        },
        {
            "binary_version": "1.5.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-project-facet-core-java"
        },
        {
            "binary_version": "1.2.401+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-ui-java"
        },
        {
            "binary_version": "1.4.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-uriresolver-java"
        },
        {
            "binary_version": "1.2.1400+eclipse3.35-1",
            "binary_name": "libeclipse-wst-sse-core-java"
        },
        {
            "binary_version": "1.7.1000+eclipse3.35-1",
            "binary_name": "libeclipse-wst-sse-ui-java"
        },
        {
            "binary_version": "1.3.100+eclipse3.35-1",
            "binary_name": "libeclipse-wst-validation-java"
        },
        {
            "binary_version": "1.3.100+eclipse3.35-1",
            "binary_name": "libeclipse-wst-validation-ui-java"
        },
        {
            "binary_version": "1.2.900+eclipse3.35-1",
            "binary_name": "libeclipse-wst-xml-core-java"
        },
        {
            "binary_version": "1.2.701+eclipse3.35-1",
            "binary_name": "libeclipse-wst-xml-ui-java"
        },
        {
            "binary_version": "1.2.101+eclipse3.35-1",
            "binary_name": "libeclipse-wst-xsd-core-java"
        }
    ]
}

Ubuntu:25.10

eclipse-wtp

Package

Name
eclipse-wtp
Purl
pkg:deb/ubuntu/eclipse-wtp@3.35-1?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.35-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.2.100+eclipse3.35-1",
            "binary_name": "libeclipse-jem-util-java"
        },
        {
            "binary_version": "1.4.100+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-core-java"
        },
        {
            "binary_version": "1.2.700+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-emf-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-emfworkbench-integration-java"
        },
        {
            "binary_version": "1.1.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-environment-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-frameworks-java"
        },
        {
            "binary_version": "1.3.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-frameworks-ui-java"
        },
        {
            "binary_version": "1.5.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-project-facet-core-java"
        },
        {
            "binary_version": "1.2.401+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-ui-java"
        },
        {
            "binary_version": "1.4.0+eclipse3.35-1",
            "binary_name": "libeclipse-wst-common-uriresolver-java"
        },
        {
            "binary_version": "1.2.1400+eclipse3.35-1",
            "binary_name": "libeclipse-wst-sse-core-java"
        },
        {
            "binary_version": "1.7.1000+eclipse3.35-1",
            "binary_name": "libeclipse-wst-sse-ui-java"
        },
        {
            "binary_version": "1.3.100+eclipse3.35-1",
            "binary_name": "libeclipse-wst-validation-java"
        },
        {
            "binary_version": "1.3.100+eclipse3.35-1",
            "binary_name": "libeclipse-wst-validation-ui-java"
        },
        {
            "binary_version": "1.2.900+eclipse3.35-1",
            "binary_name": "libeclipse-wst-xml-core-java"
        },
        {
            "binary_version": "1.2.701+eclipse3.35-1",
            "binary_name": "libeclipse-wst-xml-ui-java"
        },
        {
            "binary_version": "1.2.101+eclipse3.35-1",
            "binary_name": "libeclipse-wst-xsd-core-java"
        }
    ]
}