Description
All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996
https://github.com/eclipse/xtext-xtend/issues/759
Related Vulnerabilities
CVE-2017-2651 Vulnerability in maven package org.jenkins-ci.plugins:mailer
CVE-2022-25927 Vulnerability in maven package org.webjars.bowergithub.faisalman:ua-parser-js
CVE-2022-36890 Vulnerability in maven package org.jenkins-ci.plugins:deployer-framework
CVE-2022-41238 Vulnerability in maven package com.groupon.jenkins-ci.plugins:dotci
CVE-2022-2668 Vulnerability in maven package org.keycloak:keycloak-saml-core