* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Monday, September 1, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Comanche Nation Entertainment closes casino near Devol – KSWO 7News

    Comanche Nation Entertainment Closes Casino Near Devol in Surprising Move

    Erykah Badu Announces ‘Abi & Alan’ Album With The Alchemist Will Be Delayed – yahoo.com

    Erykah Badu Opens Up About the Delay of Her Highly Anticipated ‘Abi & Alan’ Album with The Alchemist

    If You Needed Some BTS Pics Of The Rock’s Tree Trunk Legs To Spice Up Your Day, We Got ‘Em – yahoo.com

    Need a Boost? Check Out These Epic BTS Shots of The Rock’s Tree Trunk Legs!

    Sabrina Carpenter’s pearl-clutching magic? Humor – CNN

    Sabrina Carpenter’s pearl-clutching magic? Humor – CNN

    South Park Is In Trouble And Needs To Change Course, Fast – yahoo.com

    South Park Faces Major Challenges and Must Adapt Fast to Survive

    ‘Netflix House’ entertainment complexes are coming. Here’s when they open – Los Angeles Times

    Exciting News: Netflix’s House Entertainment Complexes Are Opening Soon!

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    This Secret Technology Will Make The IPhone 17 Super Thin Air – VOI.ID

    How This Breakthrough Technology Will Make the iPhone 17 Incredibly Thin and Lightweight

    Gator football kicks off with excitement and new technology – WCJB | TV20

    Gator Football Kicks Off with Thrilling Action and Innovative Technology

    Marvell Technology (MRVL) Loses 18.6% as Growth Outlook Fails to Impress – Yahoo Finance

    Marvell Technology (MRVL) Loses 18.6% as Growth Outlook Fails to Impress – Yahoo Finance

    Propelling solar technology into a perovskite future – CORDIS

    Propelling solar technology into a perovskite future – CORDIS

    13 Top Technology Trends (2025) – Exploding Topics

    13 Game-Changing Technology Trends to Watch in 2025

    Japan’s legacy LCD and chip technology find new home in India – Nikkei Asia

    How Japan’s Breakthrough LCD and Chip Technologies Are Driving Innovation in India

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Comanche Nation Entertainment closes casino near Devol – KSWO 7News

    Comanche Nation Entertainment Closes Casino Near Devol in Surprising Move

    Erykah Badu Announces ‘Abi & Alan’ Album With The Alchemist Will Be Delayed – yahoo.com

    Erykah Badu Opens Up About the Delay of Her Highly Anticipated ‘Abi & Alan’ Album with The Alchemist

    If You Needed Some BTS Pics Of The Rock’s Tree Trunk Legs To Spice Up Your Day, We Got ‘Em – yahoo.com

    Need a Boost? Check Out These Epic BTS Shots of The Rock’s Tree Trunk Legs!

    Sabrina Carpenter’s pearl-clutching magic? Humor – CNN

    Sabrina Carpenter’s pearl-clutching magic? Humor – CNN

    South Park Is In Trouble And Needs To Change Course, Fast – yahoo.com

    South Park Faces Major Challenges and Must Adapt Fast to Survive

    ‘Netflix House’ entertainment complexes are coming. Here’s when they open – Los Angeles Times

    Exciting News: Netflix’s House Entertainment Complexes Are Opening Soon!

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    This Secret Technology Will Make The IPhone 17 Super Thin Air – VOI.ID

    How This Breakthrough Technology Will Make the iPhone 17 Incredibly Thin and Lightweight

    Gator football kicks off with excitement and new technology – WCJB | TV20

    Gator Football Kicks Off with Thrilling Action and Innovative Technology

    Marvell Technology (MRVL) Loses 18.6% as Growth Outlook Fails to Impress – Yahoo Finance

    Marvell Technology (MRVL) Loses 18.6% as Growth Outlook Fails to Impress – Yahoo Finance

    Propelling solar technology into a perovskite future – CORDIS

    Propelling solar technology into a perovskite future – CORDIS

    13 Top Technology Trends (2025) – Exploding Topics

    13 Game-Changing Technology Trends to Watch in 2025

    Japan’s legacy LCD and chip technology find new home in India – Nikkei Asia

    How Japan’s Breakthrough LCD and Chip Technologies Are Driving Innovation in India

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

Rapid7 hits out over botched vulnerability disclosure

March 6, 2024
in Technology
Rapid7 hits out over botched vulnerability disclosure
Share on FacebookShare on Twitter

Software development firm JetBrains and security specialist Rapid7 fall out over the handling of a critical vulnerability disclosure, while customers are left rushing to patch


Alex Scroxton

By

Alex Scroxton,
Security Editor

Published: 05 Mar 2024 21:31

JetBrains, the maker of a continuous integration and delivery (CI/CD) server platform called TeamCity, and cyber security firm Rapid7 are trading blows over the handling of two serious vulnerabilities in the service as customers rush to patch in the face of confirmed exploitation.

The two issues in question are tracked as CVE-2024-27198 and CVE-2024-27199. The first is an authentication bypass flaw in TeamCity’s web component via an alternative pass issue, with a CVSS base score of 9.8, meaning it is a critical issue. The second has the same effect, but has a CVSS base score of 7.3.

In a blog posting detailing the issues, Rapid7 principal researcher Stephen Fewer, who discovered the vulnerabilities, wrote: “Compromising a TeamCity server allows an attacker full control over all TeamCity projects, builds, agents and artefacts, and as such is a suitable vector to position an attacker to perform a supply chain attack.”

At the core of the disagreement lies a difference in approaches to vulnerability disclosure and patching.

The vulnerabilities were disclosed to JetBrains via its coordinated disclosure policy on Thursday 15 February 2024. JetBrains acknowledged this on Monday 19 February and reproduced the issues on Tuesday 20 February after being provided with technical analysis by Rapid7.

In Rapid7’s version of the narrative, JetBrains then suggested releasing patches privately before a public disclosure. It responded by emphasising the importance of coordinated disclosure, and outlined its stance against so-called silent patching.

Things then went quiet for several days until Friday 1 March, when Rapid7 went back to JetBrains and restated a request for more information about affected versions of TeamCity and vendor mitigation guidance. It was advised of the assigned CVE numbers, but otherwise told the issue was still under investigation.

Then, on Monday 4 March, with no communication to Rapid7, JetBrains published a blog announcing the release of the new version of TeamCity, which patched the vulnerabilities. Rapid7 said it expressed its concern that the patch was released without notification or coordination, and with no published advisories.

For TeamCity on-premise users, the botched disclosure means the ability to assess your risk factors has been taken away, and the only solution is to patch immediately

Under its own vulnerability disclosure policy, if Rapid7 becomes aware a silent patch was issued, it will “aim to publish” details of the vulnerability within 24 hours, which it has now done.

JetBrains has since published a blog on the issue, and an advisory, and stated that the CVEs were included in the release notes for the new version of TeamCity, but it has not directly responded to Rapid7’s concerns about the uncoordinated disclosure.

In JetBrains’ version of the story, it does not dispute it proposed what Rapid7 would term a silent patch, but maintained that this disclosure method followed its coordinated disclosure policy.

It said it wanted to follow this path to enable customers to make an informed decision about the risk level, to give them time to upgrade, and to stop less skilled attackers from exploiting the flaws in the interim.

JetBrains said it made a decision not to make a coordinated disclosure after learning that this would mean Rapid7 would publish full technical details of the vulnerabilities at the same time the patches dropped.

“To reiterate, we never had any intention to release a fix silently without making the full details public. As a CVE Numbering Authority (CNA), we assigned CVE IDs for both issues a day after receiving the report,” wrote Daniel Gallo, TeamCity solutions engineer at JetBrains.

“We suggested disclosing the details of the vulnerabilities in the same way we have followed in the past, with a time delay between releasing a fix and making a full disclosure, which allows our customers to upgrade their TeamCity instances.

“This suggestion was rejected by the Rapid7 team who published full details of the vulnerabilities and how to exploit them a few hours after we had released a fix to TeamCity customers.”

Silent patching: a bad idea

The approach to coordinated disclosure taken by Rapid7 is widely accepted and entirely normal within the cyber security world,

While JetBrains has not explicitly stated why it rejects this approach, writing in 2022, Rapid7’s principal security research manager, Tod Beardsley, offered a possible explanation when he said that taken at face value, silent patching might seem appropriate to some because it seems to limit the pool of people who understand the issue and how to take advantage of it.

“Silent patching is tantamount to full disclosure to a very small audience who mostly want to hurt you and your users”

Tod Beardsley, Rapid7

Outlining why this is not the case, Beardsley wrote: “When a software company release a patch … at some point it’s got to modify the code on the running software, which means it’s all available to anyone who has a running instance of the patched software and knows how to use a debugger and a disassembler. And who uses debuggers to inspect the effects of patches? Exploit developers, almost exclusively.”

With this in mind, said Beardsley, silent patching in fact limits knowledge of the patched vulnerability to skilled exploit developers, that is to say threat actors, so while it is true that silent patching cuts out casual, low-skilled hackers and script kiddies, it also excludes the good guys, legitimate pen testers, the developers of defensive technologies, incident responders, and the entire cyber community who might benefit from being able to understand the issue better and communicate it effectively.

“Most significantly, you’re excluding the most important audience for your patch: the regular IT administrators and managers who need to sort out the incoming flow of patches based on some risk and severity criteria and make the call for downtime and update scheduling based on that criteria. Not all vulnerabilities are equal, and while protectors want to get around to all of them, they need to figure out which ones to apply today and which ones can wait for the next maintenance cycle,” he wrote.

Summing up Rapid7’s argument, Beardsley said silent patching communicates vulnerability details “exclusively” to the skilled cyber criminal attackers and nation-state actors who are already targeting the vulnerable product.

“All this is to say, silent patching is tantamount to full disclosure to a very small audience who mostly want to hurt you and your users,” he concluded.

In the case of the new TeamCity vulnerabilities, the importance of coordinated disclosure takes on additional importance, given that previous issues in the service have been heavily exploited by none other than APT29, aka Cozy Bear, the cyber unit of the Russian foreign intelligence service (SVR).

For TeamCity on-premise users caught in the crossfire – cloud versions are fully patched – the guidance is simple: the botched disclosure means the ability to assess your risk factors has been taken away, and the only solution is to patch immediately.

Read more on Business continuity planning


Critical JetBrains TeamCity vulnerabilities under attack

ArielleWaldman

By: Arielle Waldman


Russian APT exploiting JetBrains TeamCity vulnerability

ArielleWaldman

By: Arielle Waldman


North Korean hackers exploit critical TeamCity vulnerability

ArielleWaldman

By: Arielle Waldman


Ransomware gang targets critical Progress WS_FTP Server bug

AlexanderCulafi

By: Alexander Culafi

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : Computer Weekly – https://www.computerweekly.com/news/366572453/Rapid7-hits-out-over-botched-vulnerability-disclosure

Tags: botchedRapidtechnology
Previous Post

ALPHV/BlackCat gang vanishes amid ransomware ‘turmoil’

Next Post

Interview: How a fundraiser became more data-savvy

Meet the man defending Trump’s political adversaries – ABC News

Meet the man defending Trump’s political adversaries – ABC News

September 1, 2025
Sky High Farm’s Biennial Blends Art, Agriculture and Ecological Urgency – observer.com

Sky High Farm’s Biennial Blends Art, Agriculture and Ecological Urgency – observer.com

September 1, 2025

After 150 Job Applications and Rescinded Offers, Computer Science Grads Face an Unforgiving Job Market

September 1, 2025
Proportion of US students taking chemistry fails to keep pace with other science disciplines – Chemistry World

Why Fewer US Students Are Choosing Chemistry Compared to Other Sciences

September 1, 2025
Going zero-waste for a month opened my eyes — here are 7 lessons I wish I knew sooner – VegOut

7 Eye-Opening Lessons I Learned from Living Zero-Waste for a Month

September 1, 2025
This Secret Technology Will Make The IPhone 17 Super Thin Air – VOI.ID

How This Breakthrough Technology Will Make the iPhone 17 Incredibly Thin and Lightweight

September 1, 2025
2 men shot and killed at Don Knabe Community Regional Park in Cerritos – ABC7 Los Angeles

2 men shot and killed at Don Knabe Community Regional Park in Cerritos – ABC7 Los Angeles

September 1, 2025
More drama to come after Australia, USA ignite Women’s Rugby World Cup – ESPN

More drama to come after Australia, USA ignite Women’s Rugby World Cup – ESPN

September 1, 2025
India Was the Economic Alternative to China. Trump Ended That. – The New York Times

How Trump’s Policies Disrupted India’s Bid to Challenge China as an Economic Powerhouse

September 1, 2025
Comanche Nation Entertainment closes casino near Devol – KSWO 7News

Comanche Nation Entertainment Closes Casino Near Devol in Surprising Move

September 1, 2025

Categories

Archives

September 2025
MTWTFSS
1234567
891011121314
15161718192021
22232425262728
2930 
« Aug    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (801)
  • Economy (819)
  • Entertainment (21,699)
  • General (16,794)
  • Health (9,860)
  • Lifestyle (834)
  • News (22,149)
  • People (821)
  • Politics (828)
  • Science (16,030)
  • Sports (21,318)
  • Technology (15,800)
  • World (800)

Recent News

Meet the man defending Trump’s political adversaries – ABC News

Meet the man defending Trump’s political adversaries – ABC News

September 1, 2025
Sky High Farm’s Biennial Blends Art, Agriculture and Ecological Urgency – observer.com

Sky High Farm’s Biennial Blends Art, Agriculture and Ecological Urgency – observer.com

September 1, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version