Uploaded image for project: 'Sourcetree For Mac'
  1. Sourcetree For Mac
  2. SRCTREE-5846

Argument injection via Mercurial repository filenames - CVE-2018-13385

XMLWordPrintable

    • Severity 1 - Critical

      There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.

      Affected versions:

      • Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.

      Fix:

      For additional details, see the full advisory.

            [SRCTREE-5846] Argument injection via Mercurial repository filenames - CVE-2018-13385

            Eric Franklin (Inactive) made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 847576 ]
            Eric Franklin (Inactive) made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 846206 ]
            Monique Khairuliana (Inactive) made changes -
            Workflow Original: JAC Bug Workflow v3 [ 3370794 ] New: SRCTREE JAC Bug Workflow [ 3736128 ]
            Monique Khairuliana (Inactive) made changes -
            Workflow Original: SourceTree Bug Workflow [ 2740415 ] New: JAC Bug Workflow v3 [ 3370794 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Security Metrics Bot made changes -
            Security Original: Reporter and Atlassian Staff [ 10751 ]
            David Black made changes -
            Security New: Reporter and Atlassian Staff [ 10751 ]
            Security Metrics Bot made changes -
            Security Original: Reporter and Atlassian Staff [ 10751 ]
            AB made changes -
            Description Original: There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.


            *Affected versions:*
            * Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.

            *Fix:*
            * Upgrade Sourcetree for macOS to version 2.7.6 or higher from https://www.sourcetreeapp.com/ .


            For additional details, see the full advisory.             		New: There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.

            *Affected versions:*
             * Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.

            *Fix:*
             * Upgrade Sourcetree for macOS to version 2.7.6 or higher from [https://www.sourcetreeapp.com/] .

            For additional details, see the [full advisory|https://confluence.atlassian.com/x/4erXO].
            David Black made changes -
            Security New: Reporter and Atlassian Staff [ 10751 ]
            AB made changes -
            Security Original: Atlassian Staff [ 10750 ]

              ablack@atlassian.com AB
              ablack@atlassian.com AB
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: