Uploaded image for project: 'Sourcetree For Mac'
  1. Sourcetree For Mac
  2. SRCTREE-5246

Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

XMLWordPrintable

    • Severity 1 - Critical

      The embedded version of Git LFS used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems running a vulnerable version of Sourcetree for macOS. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler.

      Affected versions:

      • Versions of Sourcetree for macOS starting with 2.1 before version 2.7.0 are affected by this vulnerability

      Fix:

      For additional details see the full advisory.

            [SRCTREE-5246] Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

            David Black made changes -
            Labels Original: CVE-2017-17831 advisory cvss-critical security New: CVE-2017-17831 advisory advisory-released cvss-critical security
            Monique Khairuliana (Inactive) made changes -
            Workflow Original: JAC Bug Workflow v3 [ 3372205 ] New: SRCTREE JAC Bug Workflow [ 3737774 ]
            Monique Khairuliana (Inactive) made changes -
            Workflow Original: SourceTree Bug Workflow [ 2494868 ] New: JAC Bug Workflow v3 [ 3372205 ]
            Security Metrics Bot made changes -
            Security Original: Reporter and Atlassian Staff [ 10751 ]
            David Black made changes -
            Description Original: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems a running a vulnerable version of Sourcetree for macOS. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler.


            *Affected versions:*
            * Versions of Sourcetree for macOS starting with 2.1 before version 2.7.0 are affected by this vulnerability


            *Fix:*
            * Upgrade Sourcetree for macOS to version 2.7.0 or higher from https://www.sourcetreeapp.com/ .

            For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].             		New: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems running a vulnerable version of Sourcetree for macOS. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler.


            *Affected versions:*
            * Versions of Sourcetree for macOS starting with 2.1 before version 2.7.0 are affected by this vulnerability


            *Fix:*
            * Upgrade Sourcetree for macOS to version 2.7.0 or higher from https://www.sourcetreeapp.com/ .

            For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].
            David Black made changes -
            Remote Link New: This issue links to "SECENG-971 (Security JIRA (CYBER/J))" [ 342142 ]
            David Black made changes -
            Description Original: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems a running a vulnerable version of Sourcetree for macOS. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler.


            *Affected versions:*
            * Versions of Sourcetree for macOS starting with 2.1 before version 2.7.0 are affected by this vulnerability


            *Fix:*
            * Upgrade Sourcetree for macOS to version 2.7.0 or higher from https://www.sourcetreeapp.com/ .

            For additional details see the full advisory.             		New: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems a running a vulnerable version of Sourcetree for macOS. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler.


            *Affected versions:*
            * Versions of Sourcetree for macOS starting with 2.1 before version 2.7.0 are affected by this vulnerability


            *Fix:*
            * Upgrade Sourcetree for macOS to version 2.7.0 or higher from https://www.sourcetreeapp.com/ .

            For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].
            David Black made changes -
            Link New: This issue is related to SRCTREEWIN-8261 [ SRCTREEWIN-8261 ]
            David Black made changes -
            Link Original: This issue was cloned as SRCTREEWIN-8261 [ SRCTREEWIN-8261 ]
            David Black made changes -
            Labels Original: advisory cvss-critical security New: CVE-2017-17831 advisory cvss-critical security

              Unassigned Unassigned
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: