Description
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Platform | unspecified – ≤ 4.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | eclipse | No fix yet | — |
| Ubuntu 16.04 LTS | eclipse | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Devtools 2021 | rh-eclipse +2 | 1:4.19-4.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-apache-sshd +1 | 1:2.6.0-1.2.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-batik +9 | 1.14-1.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-eclipse +6 | 1:4.19-1.3.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-eclipse-emf +3 | 1:2.25.0-1.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-jakarta-annotations +1 | 1.3.5-7.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-jetty +14 | 9.4.38-1.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-jgit +3 | 5.11.0-1.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-objectweb-asm +1 | 9.1-1.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-takari-polyglot +6 | 0.4.6-1.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-tycho +1 | 2.2.0-4.1.el7_9 | RHEA-2021:1441 |
| Red Hat Devtools 2021 | rh-eclipse-xmlgraphics-commons +1 | 2.6-1.1.el7_9 | RHEA-2021:1441 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | eclipse +1 | 4.9.0-lp152.3.3.1 | openSUSE-SU-2021:0485-1 |
Advisories 2
- RHEA-2021:1441 Red Hat Enhancement Advisory: rh-eclipse bug fix and enhancement update Red Hat Security Advisories (RHSA) · Feb 26, 2026
- openSUSE-SU-2021:0485-1 Security update for eclipse SUSE / openSUSE Security Updates · Feb 4, 2026