• Type: Bug
• Resolution: Fixed
• Priority: Highest
• Fix Version/s: None
• Affects Version/s: None
• Component/s: None
• Labels:

  • CVE-2018-13396
  • advisory
  • advisory-released
  • bugbounty
  • cvss-critical
  • rce
  • security

[SRCTREE-5985] Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo - CVE-2018-13396

Monique Khairuliana (Inactive) made changes - 30/Sep/2019 4:13 AM

Workflow

Original: JAC Bug Workflow v3 [ 3372838 ]

New: SRCTREE JAC Bug Workflow [ 3737785 ]

Monique Khairuliana (Inactive) made changes - 16/Aug/2019 1:01 AM

Workflow	Original: SourceTree Bug Workflow [ 2816492 ]	New: JAC Bug Workflow v3 [ 3372838 ]
Status	Original: Resolved [ 5 ]	New: Closed [ 6 ]

David Black made changes - 05/Nov/2018 9:21 PM

Description

Original: There was an argument injection vulnerability in Sourcetree for macOS before version 3.0.0, via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.   For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ]

New: There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 before version 3.0.0, via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.   For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ]

David Black made changes - 05/Nov/2018 9:17 PM

Labels

Original: CVE-2018-13396 advisory advisory-to-release bugbounty cvss-critical rce security

New: CVE-2018-13396 advisory advisory-released bugbounty cvss-critical rce security

David Black made changes - 05/Nov/2018 9:16 PM

Description

Original: Component in Atlassian SourceTree for macOS from version 1.02b before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.   For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ]

New: There was an argument injection vulnerability in Sourcetree for macOS before version 3.0.0, via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.   For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ]

Security Metrics Bot made changes - 31/Oct/2018 4:52 PM

Security

Original: Reporter and Atlassian Staff [ 10751 ]

David Black made changes - 16/Oct/2018 3:28 AM

Description

Original: Component in Atlassian SourceTree for macOS from version 1.02b before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.   For additional details, see the full advisory: [https://confluence.atlassian.com/display/SOURCETREEKB/Sourcetree+Security+Advisory+2018-10-03]

New: Component in Atlassian SourceTree for macOS from version 1.02b before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.   For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ]

David Black made changes - 16/Oct/2018 3:26 AM

Link

New: This issue relates to SRCTREEWIN-9077 [ SRCTREEWIN-9077 ]

David Black made changes - 16/Oct/2018 3:25 AM

Summary

Original: Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo

New: Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo - CVE-2018-13396

David Black made changes - 16/Oct/2018 3:25 AM

Labels

Original: advisory advisory-to-release bugbounty cvss-critical rce security

New: CVE-2018-13396 advisory advisory-to-release bugbounty cvss-critical rce security

Load more older events