[SRCTREE-5985] Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo - CVE-2018-13396 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Highest
Fix Version/s: None
Affects Version/s: None
Component/s: None
Labels:

Symptom Severity:
Severity 1 - Critical

There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 before version 3.0.0, via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.

For additional details, see the full advisory

relates to

SRCTREEWIN-9077 Remote Code Execution in Sourcetree for Windows, via Mercurial repo with Git subrepo - CVE-2018-13397

Closed

mentioned in: Page Failed to load; Page Failed to load

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: AB

Affected customers:: 0 This affects my team

Watchers:: 2 Start watching this issue

Created:: 11/Sep/2018 6:31 AM

Updated:: 16/Aug/2019 1:01 AM

Resolved:: 12/Sep/2018 1:08 AM

Sourcetree For Mac

Details

Description

Attachments

Issue Links

Forms

Activity

[SRCTREE-5985] Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo - CVE-2018-13396

People

Dates