This announcement is about a security vulnerability that was found in a third-party library used in JetBrains Hub. 

Administrators of some Hub installations must take further action to secure their instances.

Please read this announcement for a full update on the current situation and immediate action that you must take if you run a Hub installation.

What happened

On December 9, 2021, a security vulnerability was found in a third-party library used in JetBrains Hub. This security vulnerability affects Hub version 2018.1 to version 2021.1.14063 in standalone Hub instances and in Hub bundled with Upsource. 

To secure your Hub installation, please proceed with the steps below.

Actions for Hub administrators

If you use Hub 2017.4 or earlier, you do not need to take any further action.

If you use Hub 2018.1 or later, please take the additional steps below to secure your Hub and follow the instructions further down to subscribe to updates.

What actions you should take

• If you use Hub 2017.4 or earlier or 2021.1.14080 or later, your installation is already safe and no additional actions are required from your side.
  

• If you use Hub from 2018.1 to 2021.1.13389, please secure your installation immediately by: 
  • upgrading Hub to version 2021.1.14080.
      

• If you use Hub from 2021.1.13402 to 2021.1.14063, please secure your installation immediately by: 
  • upgrading Hub to version 2021.1.14080.  

Alternatively, you can:

• restart your Hub with the parameter `-Dlog4j2.formatMsgNoLookups=true`. A guide on how to apply a parameter to Hub can be found here (an example for Docker can be found here).

What actions we’ve taken

• We released a security update for Hub (version 2021.1.14080) on December 13, 2021. Download it here and install it.   

If you need any further assistance, please contact our support or simply comment on this blog post.

Your JetBrains YouTrack & Hub team

Hub 2021.1 is starting this year off with a new customization feature, which allows users to add custom fields to user profiles. It also adds a set of authentication enhancements, like the ability to specify multiple domains that you can use to log in with Google authentication and PKCE (proof key for code exchange) extension support. Let’s look at these improvements in more detail!

Customizable User Profiles for Full-Fledged User Management

User profiles can now store additional information along with the usual credentials, full names, and email addresses. With the new version of Hub, it is possible to add custom attributes to user profiles, for example, to store a user’s phone numbers or job roles. Also, these attributes will be accessible from YouTrack workflows, which makes it possible to use workflow logic with users positions, phone numbers, whatever is in your users’ profiles, for example, you can restrict some actions to only the company CEO.

To manage the custom attributes, just navigate to the Users page and click “Manage custom attributes”. You will be able to add new fields of different types: email, phone, string, etc., or update the existing fields on the page. New fields will immediately appear on each user’s profile page.
Also, we are planning to enhance this feature in future releases by adding the possibility to automatically map Active Directory user attributes to these custom fields and by implementing filters for custom user attributes.

Multiple Domain Support for Google Authentication

Domain restriction for Google authentication allows instance administrators to limit who can create an account on the instance using their Gmail accounts. The most popular use case for this feature is to make sure that only users from your corporate domain, that is, only your colleagues, are able to create accounts in your instance.

However, sometimes one domain is not enough. Large companies may have several domains or sometimes need to invite an external user from a third-party company to their instance. To address this, you can now specify several domains that are allowed to create accounts on the instance in Hub.

PKCE extension support for OAuth 2.0 for more secure authorization

Proof key for code exchange (PKCE) is an additional protection code that further enhances Hub authorization flows. It was created to offer desktop and mobile client applications a more secure and robust sign-in experience and is now recommended by IETF (The Internet Engineering Task Force) among other OAuth 2.0 best practices. No additional configuration is required to set up PKCE. If the client supports it, Hub will happily play along.

For the full technical details about this release, please take a look at the Release Notes. The latest Hub version can be downloaded from our website. To learn more about configuring the new features, please refer to the latest documentation.

We truly appreciate all your feedback, so please share it with us in the comment section below. And of course, please get in touch with our support if you have any questions – we’re always here to help!

Your Hub team

Hub 2020.1 introduces Organizations, an ability to suggest community translations in-context – right from the user interface, and Swagger support.

Please read ahead to learn more.

Organizations

Organizations offer administrators a convenient way to group projects together. Organizations may follow your actual team structure, or correspond to parts of your business process, or work in your custom way of grouping. With Organizations, you’ll find it easy to find and manage projects in complex teams.

Enabling Organizations is the first step in our effort to make Hub a better fit for your custom development environments and various business structures, with all their complexity and unique demands. We are planning to provide user grouping and permission management options on top of Organizations later this year.

In-context translations

The Hub user interface is localized to English, French, German, Japanese, Russian, and Spanish. There is also an option to switch to one of the languages supported by the Hub user community: Chinese (Simplified), Czech, Hebrew, Hungarian, Italian, Korean, Polish, or Portuguese.

We’re making it even easier for users of these community-supported languages to make a difference. When you switch to the in-context translation mode, all parts of the UI that are not yet translated will be highlighted, and you will be able to suggest translations for them without leaving the application. Once approved by JetBrains, your translations will become visible to all who use Hub in your language.

The translation process is visible in real-time. Even the dynamic part of the application and strings that contain placeholders can be translated this way.

Swagger

Hub 2020 features a built-in Swagger Open API 3.0 definition file. It offers an easy way to explore and consume the Hub REST API to integrate your application with Hub. Please refer to the GitHub page to locate compatible code generator tools for your favorite runtime.

For more information about this release, please see the Release Notes. Refer to the documentation to learn more about configuring these features.

Give it a try and share your thoughts in the comments below!

DOWNLOAD NOW

If you have any questions, please contact our support team.

Universal 2nd Factor Authentication

Hub now supports the universal 2nd-factor authentication standard for two-factor authentication. As a result, you can use a token-based interface as a second authentication factor. This provides support for a range of hardware security keys and biometric technologies.

Community-based Language Support

The Hub user interface is localized for US English, French, German, Japanese, Russian, and Spanish. While this is a good start, there are a lot of other languages out there. You now have the option to switch to a language that is supported by the Hub user community. If you want to work with Hub in a language that isn’t officially supported by JetBrains, you can contribute your own translations.

Required Two-factor Authentication

A new option in the group settings lets you require that members of the group enable two-factor authentication for their Hub accounts. This helps you secure access to your Hub installations and the services that are connected to it.

Discontinued Feature

Internet Explorer Support

From Hub version 2019.1, we no longer guarantee stable performance in any version of Internet Explorer and no longer fix bugs that can only manifest themselves in this browser. If you are currently working with Hub in IE 11, we recommend that you switch to another web browser.

For more information about this release, please check the Release Notes. Refer to the documentation to learn more about the features configuration.

Sounds good? Give it a try!

DOWNLOAD NOW

If you have any questions, please contact our support team.

What happened

During a regular security audit on December 7th, 2018, we discovered a security vulnerability in JetBrains Hub, which provides authorization and authentication services to some of our other products including Upsource and YouTrack. This security vulnerability affected Upsource instances starting from version 2018.2.1013 through version 2018.2.1141 where the issue was fixed and YouTrack instances starting from version 2018.2.10218 through version 2018.3.47965 where the issue was fixed.

What information was compromised

This security issue affected all Hub instances and other products that rely on Hub, making it possible for users to elevate the permissions that were available to their own accounts in Upsource and YouTrack.

We don’t have any information to confirm whether access to your Upsource or YouTrack installation was compromised.

What actions we’ve taken

We fixed the issue on December 10th, 2018 and released updated versions of Upsource on December 18th, 2018 and YouTrack on December 12th, 2018. We’ve also added automated tests to check for this vulnerability whenever changes are deployed to the code base.

What actions you should take

Please upgrade to the latest build from our website if you are using YouTrack Standalone and to the latest build from our website if you are using Upsource. If you are a YouTrack InCloud customer, we have already applied the fix to your YouTrack InCloud instance.

If you need any further assistance, please contact our Support Engineers.

IdP-initiated SSO for SAML

We’ve updated the SAML 2.0 authentication module to let you initiate single sign-on requests from the identity provider side.

Allowed Organizations for GitHub Authentication

A new setting for the GitHub auth module lets you restrict logins to members of specific GitHub organizations. If your Hub installation is accessible over the internet, you can let users who belong to your organization sign in with their GitHub accounts.

LDAP Group Mappings

You can now map groups from a directory service to groups in Hub. These configuration options are available for the Active Directory, LDAP, and Open LDAP auth modules.

For more information about this release, please check the Release Notes.

Sounds good? Give it a try!

Download Now

If you have any questions, please contact our support team.

Visual Redesign

Hub gets a fresh, new look! We’ve updated the visual appearance of every page in the application with redesigned controls and a polished theme using components from JetBrains’ open-source library for web-based products, Ring UI.

Two-factor Authentication

To add an extra layer for the security of your account we’ve added a two-factor authentication support. Pair your Hub account with an identity verification app on your mobile device or on your desktop (for example, Google Authenticator) to start using the feature.

Here’s a short instruction on how to enable two-factor authentication for your account:

1. Install an app that supports 2FA on your mobile device.
2. In Hub, click your avatar, then select Profile.
3. Locate the Two-factor authentication setting and click the Enable button.
   The Enable Two-factor Authentication dialog opens.
4. Use one of the following methods to pair the app with your Hub account:
   a. Scan the QR code with your built-in camera. On most devices, you’re prompted to copy the code to your authentication app.
   b. Open your authentication app and enter the key that is displayed in the dialog.
5. Enter the 6-digit code that is generated by your authentication app into the input field in the dialog.
6. Click the Confirm button.
   a. Two-factor authentication is enabled for your Hub account.
   b. Whenever you log into any of the aforementioned services with your Hub credentials, you are asked to enter the code that is generated by your authentication app.

To learn the full instruction, please check the documentation.

Application Passwords

To help you stay connected to third-party services that don’t support two-factor authentication, we’ve also added support for application passwords. Use these randomly generated passwords to give an app or device permission to access your Hub account.

Global Password Change Requests

A new action in the Hub authentication module lets an administrator request that all users change the passwords they use for their Hub accounts. When you believe that a malicious user has obtained unauthorized access, use this feature to keep your installation secure. You can either request a specific user to change the password or perform this action for all users.

Improvements

Custom Order for Favorite Dashboards

You can now apply a custom order to your list of favorite dashboards. Place your dashboards in the desired sequence and page through them in the logical order.

Access Interface Updates

The redesigned Access tab gives you better insight into the roles that are assigned to users and groups in your projects. You also have direct access to the operations you need to revoke access rights all on one page. The updated layout has also been applied to the Roles tabs for users and groups.

Access Token Timeout

A new setting for authentication modules lets you specify the maximum lifetime for access tokens. Use this setting to limit the amount of time a malicious user can access the application.

Search Improvements

We’ve changed how Hub parses values in the database for search queries. As a result, it’s now possible to filter for users by email address domain. You can also find possible matches for things like usernames and permission keys when you type partial values.

For more information, please check the Release Notes.

Sounds great? Give it a try!

Download Now

If you have any questions, please contact our support team.

Built-in TLS Support

Hub installation packages now provide out-of-the-box support for secure connections over TLS. Upload your server certificate during installation or upgrade and encrypt data in transit without setting up a reverse proxy.

SAML Authentication module

This authentication module lets you configure Hub as a SAML service provider. This lets users log in to Hub and the services that are connected to it with credentials from a third-party SAML identity provider.

Throttling by Login

In Hub 2018.2 the IP-based throttling feature has been replaced with the option to apply rate limits to failed login attempts per login. When used together with a reCAPTCHA challenge, this feature protects your installation from brute-force attacks without blocking users who have simply forgotten their passwords.

We have also moved the settings that affect user authentication from the System Settings page to a single page that stores common settings for all authentication modules.

Personal Data Management

We’ve added new options that help you comply with requests from users who want to access or erase their personal data.

Updates and Enhancements

Project Overview Enhancements

Project Overview pages now show widgets and README files on separate tabs. This means that you can view widgets without scrolling to the bottom of the page.

Groups and Teams

New views on the Groups page show you a list of project teams and a mixed mode that shows both groups and teams. We also added an action on this page that lets you merge a group into a team.

Use this operation to eliminate group assignments that duplicate permissions that are granted to a project team.

Cloning Roles

Create a role that is similar but not identical to an existing role with just a few clicks. Use this action to create a new role with a set of permissions that is identical to an existing role, then add or remove permissions as desired.

Common Settings for Auth Modules

All authentication-related settings have moved from the System Settings page to a new Common Settings page for all authentication modules. This page also contains configuration options for the new login-based throttling feature and the input fields for connecting to Google reCAPTCHA.

Attribute Configuration for SAML Service Providers

When using Hub as a SAML identity provider, you now have the option to specify the attributes that the SAML service provider uses to store the user login, full name, and email address.

For more information, please check the Release Notes.

Sounds great? Download Hub 2018.2 today and enjoy a new version!
If you have any questions, please contact our support team.

Hub 2018.1 introduces a project overview page, custom widgets and other improvements.

New Features

Project overview page

Hub 2018.1 introduces the Project Overview page. The main purpose of this page is to give users a more convenient way to view the information related to the project. This page displays project-specific information like team members, the project description, and integrations. It also provides a dashboard-like interface where you can add widgets that let you monitor the activity in your project.

User agreement

We’ve added a feature that lets you store a user agreement that is presented to users who log in to Hub. To access and use Hub, users must accept the agreement.

This lets you collect and track individual acceptance of an information notice as outlined in the General Data Protection Regulation (GDPR) requirements for businesses that operate in EU member states.

Custom widgets

The Custom Widgets feature has been promoted from experimental to public, which means it’s automatically enabled in Hub 2018.1. This feature lets you upload custom widgets to your dashboard.

We have also integrated this feature with the JetBrains Plugin Repository. Here, you can access widgets that have been developed by other users and share widgets with the community by uploading your own. Support for this feature has also been added to the new Project Overview page. Join YouTrack Community on slack to exchange knowledge about custom widgets.

Per-user localization

We have added an option that lets you choose the display language for Hub on a per-user basis. With this feature enabled you will be able to see the page headers, menus, and controls in your preferred language. You can choose your preferred language on the profile page.

Docker Image

Hub 2018.1 is available as a Docker image. Enjoy easy set up with the recommended system settings applied out of the box!

Improvements

Email verification

We’ve added a new option to the Hub authentication module that lets you mandate that users verify their email address as a requirement to access Hub. This option improves the security of your installation, especially when self-registration is enabled. If you are an administrator, you can enable this feature in the system settings.

Smart Login States

When you log out of Hub, you are logged out of the application in all browser tabs. Previously, inactive browser tabs would only be logged out after a set period of inactivity. This provides a more reliable and predictable means of logging out of Hub.

If you access Hub as a guest (meaning that you are not logged in with your own account) and open pages in multiple tabs, logging in on one of these tabs logs you into your account on all tabs.

When your computer sleeps or hibernates, you are not immediately redirected to an error page that tells you that you have been disconnected from the internet. When you wake the computer up, you are given the option to try again after the connection is reestablished. Your session is restored to the page that was previously shown.

For more information, please check the Release Notes.

Sounds great? Download Hub 2018.1 today and enjoy a new version!
If you have any questions, please contact our support team.

Hub 2017.4 introduces Japanese Localization, Redesigned Projects Page, Enhanced User Tooltips, and other improvements.

Japanese Localization

こんにちは! Hub speaks Japanese now! For the past few years, we’ve noticed that the usage of our team tools has grown in Japan. That’s why we felt it was important to add Japanese to the set of supported system languages. If your team speaks Japanese, change the system language and let the whole team enjoy Hub without getting lost in translation.

Redesigned Projects Page

We have fully redesigned the Projects page to give you a more convenient way to view the projects that you’re interested in. Mark projects as favorites and jump straight to pages and actions that are supported by connected services. If you’re using JetBrains Toolbox and the project is connected to a VCS, you can copy the VCS link or open the project in IntelliJ IDEA.

Enhanced User Tooltips

Tooltips for user links and avatars now display user profile cards. A profile card shows the user’s name, login, and email address. These cards are available anywhere you find users in Hub — for project teams, group members, licenses, and even audit events.

Redefined Project Teams

Hub 2017.4 brings you fully redesigned project teams and the ability to manage members of a project team directly. The project team was redefined to include users and groups who are assigned to the project. You can grant roles to every member of the project team with just a few clicks. This update gives you a whole new experience and makes the process for managing team members smooth and clear.

We’ve also added a setting that lets you manage the owner of the project.

Improvements

Access Management Redesign

We’ve improved the visual representation for access management interfaces. For users and groups, the Roles tab gives you an overview of each role assignment and the permissions that are available to the user or group in each project. For projects, the Access tab shows you how each user and group is granted a role in the project and the corresponding set of permissions that are assigned to each role.

License Management page Redesign

The updated user interface for user license management gives you greater control over the users and group members who are granted a license in a connected service.
In addition, you now have the option to remove a license from a group without revoking the license from its members.

For more information, please check the Release Notes.

Sounds great? Download Hub 2017.4 today and enjoy a new version!
If you have any questions, please contact our support team.

Since a recent change that was applied by Microsoft, our Azure AD authentication module no longer works. Authentication requests that are sent to the Azure AD service return code 404 without an informative error message. This issue can not be fixed on our side but rather requires changes from the Microsoft side.

How does this affect you?

If you’ve configured and used the Microsoft Azure AD authentication module, you won’t be able to log in using it anymore. We’re very sorry for any inconvenience caused.

What actions have we taken?

We’ve reported this problem to Microsoft, but unfortunately, we can’t expect it to be resolved in the nearest future.

What can you do?

At the moment, we don’t have a workaround to allow you use your AD user accounts. We can recommend that you set up and use one of the other authentication modules.

You can also watch the progress in this issue in our tracker.

Ring UI library gives you the power of complex UI controls that have been developed at JetBrains over the years. It contains over 50 React controls, ranging from simple links and buttons to sophisticated controls, such as Date Picker or Data List. This library is extensively used inside YouTrack, Hub, Upsource, and other products, and we are committed to developing and maintaining it for many years to come.

One example of how you might use Ring UI library would be to create custom widgets for your dashboard in Hub so that you can match the style of your favorite JetBrains user interfaces. Please follow the Quick Start Guide to explore the library.

Your feedback is really appreciated, so please share it with us in the comment section below or report bugs in our tracker.

We are thrilled to see what you will create using Ring UI!