Description
All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996
https://github.com/eclipse/xtext-xtend/issues/759
Related Vulnerabilities
CVE-2022-36034 Vulnerability in npm package nitrado.js
CVE-2016-9606 Vulnerability in maven package org.jboss.resteasy:resteasy-yaml-provider
CVE-2022-39300 Vulnerability in npm package node-saml
CVE-2022-28355 Vulnerability in maven package org.scala-js:scalajs-library_2.12
CVE-2023-50422 Vulnerability in maven package com.sap.cloud.security:java-security