A vulnerability has been found in PyCharm Community and Professional, potentially resulting in arbitrary code execution.

Announced

2021-07-20

Revised

2021-07-20

Access

remote

Bugs

#797892

Advisory

https://security.gentoo.org/glsa/202107-45

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-util/pycharm-community	*	< 2021.1.2	>= 2021.1.2
dev-util/pycharm-professional	*	< 2021.1.2	>= 2021.1.2

Background

PyCharm is the Python IDE for professional developers.

Description

Insufficient validation exists within PyCharm’s checks for fetching projects from VCS.

Impact

If a victim can be enticed into fetching a VCS project via PyCharm, a remote attacker could achieve remote code execution.

Workaround

There is no known workaround at this time.

Resolution

All PyCharm Community users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=dev-util/pycharm-community-2021.1.2"

All PyCharm Professional users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=dev-util/pycharm-professional-2021.1.2"

References

• CVE-2021-30005