[SRCTREEWIN-13410] RCE via git-lfs in Sourcetree for Windows - CVE-2020-27955 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: None
Affects Version/s: 3.3.9
Component/s: Git
Labels:

Symptom Severity:
Severity 1 - Critical

There was an argument injection vulnerability in SourceTree for Windows introduced through git-lfs. An attacker could create a malicious repository which, after being cloned in SourceTree for Windows and enabled with git-lfs, is able to exploit this issue to gain code execution on the system.

Affected versions:

Version 3.3.9 and earlier

Fix

You can download the latest version of the standard installer or the enterprise installer.

For additional details, see the full advisory

was cloned as

SRCTREEWIN-13480 RCE via git-lfs in Sourcetree for Windows - CVE-2021-21237

Closed

mentioned in: Page Failed to load; Page Failed to load; Page Failed to load; Page Failed to load; Page Loading...

(1 mentioned in)

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Mitchell Johnson

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 07/Jan/2021 5:07 PM

Updated:: 13/Dec/2023 5:37 PM

Resolved:: 07/Jan/2021 5:08 PM

Sourcetree for Windows

Details

Description

Attachments

Issue Links

Forms

Activity

[SRCTREEWIN-13410] RCE via git-lfs in Sourcetree for Windows - CVE-2020-27955

People

Dates