CVE-2024-39878: 
JetBrains TeamCity vulnerability analysis and mitigation

A security vulnerability was identified in JetBrains TeamCity versions prior to 2024.03.3, where private keys could be exposed through the GitHub App Connection testing functionality. The vulnerability was assigned CVE-2024-39878 and was disclosed on July 1, 2024 (CVE Details).

The vulnerability is classified as CWE-522 (Insufficiently Protected Credentials). According to the National Vulnerability Database, it received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, while JetBrains assessed it with a CVSS v3.1 base score of 4.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N (NVD).

The vulnerability could result in the exposure of private keys during the process of testing GitHub App Connection, potentially compromising the security of affected TeamCity installations (JetBrains Advisory).

The vulnerability requires network access and can be exploited with low attack complexity. According to the CVSS metrics, no user interaction is required for exploitation based on the NVD assessment, though JetBrains' scoring indicates that user interaction is required (NVD).

The vulnerability has been addressed in TeamCity version 2024.03.3. Users are advised to upgrade to this version or later to mitigate the security risk (JetBrains Advisory).