From 0b53548db2f6977e535d72de5dc490c062809cd6 Mon Sep 17 00:00:00 2001
From: Wayne Beaton <wayne.beaton@eclipse-foundation.org>
Date: Thu, 13 Jun 2019 16:57:32 -0400
Subject: [PATCH] CVE-2019-11770

---
 2019/11xxx/CVE-2019-11770.json | 62 ++++++++++++++++++++++++++++++----
 1 file changed, 56 insertions(+), 6 deletions(-)

diff --git a/2019/11xxx/CVE-2019-11770.json b/2019/11xxx/CVE-2019-11770.json
index 6cd538e7ce1..6accb8c6987 100644
--- a/2019/11xxx/CVE-2019-11770.json
+++ b/2019/11xxx/CVE-2019-11770.json
@@ -1,17 +1,67 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security@eclipse.org",
         "ID": "CVE-2019-11770",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "Eclipse Buildship",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_affected": "<",
+                                            "version_value": "3.1.1"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "The Eclipse Foundation"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JARs or other dependencies were compromised, any developers using these could continue to be infected past updating to fix this."
+            }
+        ]
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "name": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=547734",
+                "refsource": "CONFIRM",
+                "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=547734"
+            },
+            {
+                "name": "https://github.com/eclipse/buildship/issues/855",
+                "refsource": "CONFIRM",
+                "url": "https://github.com/eclipse/buildship/issues/855"
             }
         ]
     }