Uploaded image for project: 'Sourcetree for Windows'
  1. Sourcetree for Windows
  2. SRCTREEWIN-7663

Remote Code Execution via Git and Mercurial - (CVE-2017-1000117, CVE-2017-1000115, CVE-2017-1000116)

XMLWordPrintable

    • Severity 1 - Critical

      SourceTree for Windows is affected by vulnerabilities found in the Git and Mercurial software. This vulnerability can be triggered through a malicious repository when it is checked out using SourceTree. From version 0.8.4b of SourceTree for Windows this vulnerability can be triggered from a webpage through the use of the SourceTree URI handler.

      Affected versions:

      • Versions of SourceTree for Windows starting with 0.5.1.0 before version 2.1.10 are affected by this vulnerability.

      Fix:

      For additional details see the full advisory.

            [SRCTREEWIN-7663] Remote Code Execution via Git and Mercurial - (CVE-2017-1000117, CVE-2017-1000115, CVE-2017-1000116)

            Yoichi NAKAYAMA added a comment -

            SourceTree Version 2.1.11.0 was released, and I get git version 2.4.1 after upgrading it manually from SourceTree configuration dialog. Thanks!

            https://www.sourcetreeapp.com/update/windows/ga/ReleaseNotes_2.1.11.0.html

            Yoichi NAKAYAMA added a comment - SourceTree Version 2.1.11.0 was released, and I get git version 2.4.1 after upgrading it manually from SourceTree configuration dialog. Thanks! https://www.sourcetreeapp.com/update/windows/ga/ReleaseNotes_2.1.11.0.html

            Yoichi NAKAYAMA added a comment -

            Hi. I've updated SourceTree for Windows to Version 2.1.10.0, but it downloads PortableGit-2.13.2-32-bit.7z.exe from downloads.atlassian.com. I think it is CVE-2017-1000117 vulnerable. When is the fixed version delivered?

            Yoichi NAKAYAMA added a comment - Hi. I've updated SourceTree for Windows to Version 2.1.10.0, but it downloads PortableGit-2.13.2-32-bit.7z.exe from downloads.atlassian.com. I think it is CVE-2017-1000117 vulnerable. When is the fixed version delivered?

              Unassigned Unassigned
              mhart@atlassian.com Matt Hart (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: