Datagrip
Monthly
The embedded browser in JetBrains desktop IDEs - IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover and DataSpell - continues to trust revoked intermediate certificates, so an attacker holding a man-in-the-middle position on an HTTPS connection opened from that browser can present a chain anchored in a revoked eMudhra intermediate and have it accepted, exposing or altering data the user believes is protected by TLS. Reachability is narrow: the victim must actually load an HTTPS resource in the embedded browser, the attacker must be able to intercept that specific TLS session, and a revoked-but-previously-issued eMudhra intermediate must be available, so ordinary coding activity that never touches the embedded browser is not affected. No public exploit identified at time of analysis, exploitation has not been confirmed, and the issue is prioritized for remediation this week rather than as an emergency; JetBrains has published fixed builds for every affected product line.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The embedded browser in JetBrains desktop IDEs - IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover and DataSpell - continues to trust revoked intermediate certificates, so an attacker holding a man-in-the-middle position on an HTTPS connection opened from that browser can present a chain anchored in a revoked eMudhra intermediate and have it accepted, exposing or altering data the user believes is protected by TLS. Reachability is narrow: the victim must actually load an HTTPS resource in the embedded browser, the attacker must be able to intercept that specific TLS session, and a revoked-but-previously-issued eMudhra intermediate must be available, so ordinary coding activity that never touches the embedded browser is not affected. No public exploit identified at time of analysis, exploitation has not been confirmed, and the issue is prioritized for remediation this week rather than as an emergency; JetBrains has published fixed builds for every affected product line.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.