Description
In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
Remediation
References
https://snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377
Related Vulnerabilities
CVE-2017-1000424 Vulnerability in npm package electron
CVE-2017-16147 Vulnerability in npm package shit-server
CVE-2020-15813 Vulnerability in maven package org.graylog2:graylog2-server
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-engine
CVE-2021-41184 Vulnerability in maven package org.webjars.bower:jquery-ui