so rapid7 is mad that jetbrains fixed the vulns they reported? isn't that the point of reporting vulnerabilities? why is rapid7 threatening to release the details in 24 hours?
No. They are mad that they vulnerabilities were _silently_ fixed.
> Rapid7 says it reported the two TeamCity vulnerabilities in mid-February, claiming JetBrains soon after suggested releasing patches for the flaws before publicly disclosing them.
So JetBrains wanted to have a patch ready before disclosing the vulnerability publicly. It seems they were working on it and were working with Rapid7. I am struggling to think how it would be better for users if an unpatched vulnerability is released before a patch is available. What's the thinking here, that users will take additional precautions to secure the application while they wait for a patch?
The first sentence.
>Security shop Rapid7 is criticizing JetBrains for flouting its policy against silent patching
Why Rapid7 doesn't like silent patching can be found here: https://www.rapid7.com/blog/post/2022/06/06/the-hidden-harm-...
> Rapid7 spotted fresh patches for CVE-2024-27198 and CVE-2024-27199 on Monday, without a published security advisory and without telling the researchers.
What do you mean?
They released patches without saying they were related to a vulnerability and without notifying Rapid7. That is the textbook definition of what a silent patch is.
I'm genuinely struggling to understand what went wrong here.
Maybe this paragraph from the article makes it clear?
>Rapid7 claims that after more than a week of radio silence from JetBrains on the coordinated disclosure matter, Rapid7 spotted fresh patches for CVE-2024-27198 and CVE-2024-27199 on Monday, without a published security advisory and without telling the researchers.
That makes this whole thing fall under Rapid7's silent patching policy.
https://blog.jetbrains.com/teamcity/2024/03/our-approach-add...
And this is the part Rapid7 presumably took issue with.
>At this point, we made a decision not to make a coordinated disclosure with Rapid7
As well as
>We published a blog post about the release. This blog post intentionally didn’t mention the security issues in detail
Which is presumably the blog post that Rapid7 saw, which triggered their silent patching policy.
Although, after reading all the blog posts (from Jetrbrains, and from Rapid7), I think this is a much more standard affair than The Reg tries to spin in its article.