In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3.
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pycharm | Jetbrains | 2019.2.5 (including) | 2019.2.5 (including) |
| Pycharm | Jetbrains | 2019.3 (including) | 2019.3 (including) |
Potential Mitigations
Related Attack Patterns
References
- https://blog.jetbrains.com/blog/2020/04/22/jetbrains-security-bulletin-q1-2020/
- https://gist.github.com/rubyroobs/5d273895512df5b86d5e7e1a703c8028
- https://twitter.com/_ruby/status/1234457530790600704
- https://blog.jetbrains.com/blog/2020/04/22/jetbrains-security-bulletin-q1-2020/
- https://gist.github.com/rubyroobs/5d273895512df5b86d5e7e1a703c8028
- https://twitter.com/_ruby/status/1234457530790600704