[ GLSA 202107-45 ] PyCharm Community, Professional

[GLSA]

Gentoo Linux Security Advisory

Title: PyCharm Community, Professional: Remote code execution (GLSA 202107-45)
Severity: normal
Exploitable: remote
Date: 2021-07-20
Bug(s): #797892
ID: 202107-45

Synopsis

A vulnerability has been found in PyCharm Community and
Professional, potentially resulting in arbitrary code execution.


Background

PyCharm is the Python IDE for professional developers.

Affected Packages

Package: dev-util/pycharm-community
Vulnerable: < 2021.1.2
Unaffected: >= 2021.1.2
Architectures: All supported architectures

Package: dev-util/pycharm-professional
Vulnerable: < 2021.1.2
Unaffected: >= 2021.1.2
Architectures: All supported architectures


Description

Insufficient validation exists within PyCharm’s checks for fetching
projects from VCS.


Impact

If a victim can be enticed into fetching a VCS project via PyCharm, a
remote attacker could achieve remote code execution.


Workaround

There is no known workaround at this time.

Resolution

All PyCharm Community users should upgrade to the latest version: