JetBrains is responding to the widespread security crisis affecting the certificate authority eMudhra, which impacts certificate trust in various software and development environments, including several of the company's core products. The company's security and product teams are assessing the impact and releasing the necessary updates to address this vulnerability.
The details of the incident trace back to a security researcher discovering a weakness in how private keys associated with eight intermediate certificates belonging to eMudhra were generated. This could potentially allow an attacker to create certificates that appear trusted to systems that continue to accept those affected chains. Although operating systems, software, and browsers have moved to block the certificates in question, applications that use separate or embedded trust stores require additional updates.
Impact on JetBrains products
The company confirmed that the issue affects its diverse product suite, including Integrated Development Environments (IDEs), the Toolbox App, TeamCity servers, YouTrack, Hub, and other developer tools. Notably, many JetBrains products, whether desktop, on-premise, or cloud services, operate in a Java-based runtime environment, including JetBrains Runtime, which is the company's build of the Java runtime environment and trusted the affected certificates just like other environments.
The company is prioritizing short-term remediation based on severity level and potential customer impact, with updates being released sequentially. As for cloud services such as JetBrains AI, Qodana Cloud, TeamCity Cloud, and YouTrack Cloud, the company has directly updated its infrastructure without requiring user intervention, except for TeamCity Cloud customers using self-hosted build agents, who are required to update their Java environment.
What users should do
The company recommends that developers and users take immediate practical steps to ensure security, which include:
- Installing available security updates for JetBrains products as soon as they are released.
- Keeping operating systems and runtime environments up to date, and applying the latest updates including trust certificate store updates.
- Following product-specific guidance if a direct security update is not yet available.
- Updating the Java environment used in the application, or removing the affected root certificates from the trust store if direct product updates are not feasible.
The company emphasized that completely disabling certificate validation or weakening validation mechanisms as a temporary workaround is strongly discouraged. The teams continue to review certificate trust and prepare further fixes to be provided via release notes and security advisories.