PT-2020-12782 · Jetbrains+1 · Pycharm+1

Ruby Nealon · Published 2020-04-10 · Updated 2022-04-06 · CVE-2020-11694

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains PyCharm versions 2019.2.5 through 2019.2.5 JetBrains PyCharm versions 2019.3 through 2019.3

Description The issue concerns the inclusion of Apple Notarization Service credentials in certain versions of JetBrains PyCharm on Windows.

Recommendations For version 2019.2.5, update to version 2019.2.6 to resolve the issue. For version 2019.3, update to version 2019.3.3 to resolve the issue.

Exploit

Fix

Cleartext Storage of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-312

CWE-522

Related Identifiers

CVE-2020-11694

Affected Products

Notarization Service

Pycharm

References · 6

• 🔥 https://twitter.com/_ruby/status/1234457530790600704 · Exploit
• https://osv.dev/vulnerability/CVE-2020-11694 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11694 · Security Note
• https://blog.jetbrains.com/blog/2020/04/22/jetbrains-security-bulletin-q1-2020 · Vendor Advisory
• https://gist.github.com/rubyroobs/5d273895512df5b86d5e7e1a703c8028 · Note
• https://t.me/cvenotify/2653 · Telegram Post