Post
by GLSA »
Gentoo Linux Security Advisory
Title:
PyCharm Community, Professional: Remote code execution ([glsa=202107-45]GLSA 202107-45[/glsa])
Severity:
normal
Exploitable:
remote
Date: 2021年07月20日
Bug(s):
#797892
ID: 202107-45
Synopsis
A vulnerability has been found in PyCharm Community and
Professional, potentially resulting in arbitrary code execution.
Background
PyCharm is the Python IDE for professional developers.
Affected Packages
Package: dev-util/pycharm-community
Vulnerable: < 2021年1月2日
Unaffected: >= 2021年1月2日
Architectures: All supported architectures
Package: dev-util/pycharm-professional
Vulnerable: < 2021年1月2日
Unaffected: >= 2021年1月2日
Architectures: All supported architectures
Description
Insufficient validation exists within PyCharmâ€TMs checks for fetching
projects from VCS.
Impact
If a victim can be enticed into fetching a VCS project via PyCharm, a
remote attacker could achieve remote code execution.
Workaround
There is no known workaround at this time.
Resolution
All PyCharm Community users should upgrade to the latest version:
Code: Select all
# emerge --sync
# emerge --ask --oneshot --verbose
">=dev-util/pycharm-community-2021年1月2日"
All PyCharm Professional users should upgrade to the latest version:
Code: Select all
# emerge --sync
# emerge --ask --oneshot --verbose
">=dev-util/pycharm-professional-2021年1月2日"
Last edited by
GLSA on Sat Jan 22, 2022 5:20 am, edited 2 times in total.