Security readout for executives and security teams
Plain-English summary
TeamCity generated Kotlin DSL settings could use an unencrypted connection when resolving build artifacts. In a CI environment, that can expose artifact downloads to interception or tampering if traffic crosses an untrusted network. JetBrains says the issue was fixed in TeamCity 2018.2.3; the sources do not provide CVSS or active exploitation evidence.
Executive priority
Prioritize remediation for TeamCity environments that build or publish production software. The issue is not proven actively exploited, but CI artifact tampering can affect downstream software integrity. Patch verification and configuration review are appropriate near-term actions.
Technical view
CVE-2019-12845 concerns generated Kotlin DSL settings in JetBrains TeamCity that allowed artifact resolution over unencrypted connections. The bundle does not identify affected version ranges beyond stating the fix in 2018.2.3, nor does it assign CWE or CVSS. The main concern is build supply-chain integrity where artifact resolution relies on plaintext transport.
Likely exposure
Likely limited to JetBrains TeamCity deployments using generated Kotlin DSL settings before the 2018.2.3 fix. Exposure depends on whether those settings resolved artifacts over unencrypted links and whether network paths could be observed or modified.
Exploitation context
The source bundle does not cite public exploitation, exploit code, or CISA KEV inclusion. Practical abuse would require an opportunity to interfere with unencrypted artifact resolution traffic; evidence is insufficient to say this was exploited in the wild.
Researcher notes
The public record is sparse: no CVSS, CWE, detailed affected range, or exploit evidence is included. Anchor analysis to the JetBrains bulletin and CVE record. Avoid expanding impact beyond unencrypted artifact resolution in generated Kotlin DSL settings.
Mitigation direction
- Upgrade TeamCity to version 2018.2.3 or later.
- Review JetBrains advisory guidance for any version-specific instructions.
- Ensure generated Kotlin DSL artifact resolution uses encrypted transport where configurable.
- Remove or replace plaintext artifact repository URLs in CI settings.
- Treat build artifacts from affected periods as potentially lower trust.
Validation and detection
- Confirm the running TeamCity version is 2018.2.3 or later.
- Inventory projects using generated Kotlin DSL settings.
- Check artifact repository URLs for unencrypted transport.
- Review build logs for artifact resolution from plaintext endpoints.
- Document any affected pipelines and remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-12845 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.