Loading...

XML

Word

Printable

Type: Bug
Resolution: Fixed
Priority: Highest
Fix Version/s: 2.7
Affects Version/s: 2.1
Component/s: None
Labels:

Symptom Severity:
Severity 1 - Critical

The embedded version of Git LFS used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems running a vulnerable version of Sourcetree for macOS. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler.

Affected versions:

Versions of Sourcetree for macOS starting with 2.1 before version 2.7.0 are affected by this vulnerability

Fix:

Upgrade Sourcetree for macOS to version 2.7.0 or higher from https://www.sourcetreeapp.com/ .

For additional details see the full advisory.

is related to

SRCTREEWIN-8261 Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

Closed

relates to

SRCTREE-5243 Various argument and command injection issues in Sourcetree for macOS - CVE-2017-14592

Closed

SRCTREE-5244 Mercurial: arbitrary command execution in mercurial repositories with a git submodule - CVE-2017-17458

Closed

SRCTREEWIN-8256 Various argument and command injection issues - CVE-2017-14593

Closed

SRCTREEWIN-8257 Mercurial: arbitrary command execution in mercurial repositories with a git submodule - CVE-2017-17458

Closed

SECENG-971 Loading...

(1 relates to)

Assignee:: Unassigned

Reporter:: David Black

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Created:: 21/Dec/2017 5:04 AM

Updated:: 13/Nov/2019 11:47 PM

Resolved:: 21/Dec/2017 5:06 AM

Details

Description

Attachments

Issue Links

Forms

Activity

People

Dates