Uploaded image for project: 'Sourcetree for Windows'
  1. Sourcetree for Windows
  2. SRCTREEWIN-8257

Mercurial: arbitrary command execution in mercurial repositories with a git submodule - CVE-2017-17458

XMLWordPrintable

    • Severity 1 - Critical

      The embedded version of Mercurial used in Sourcetree for Windows was vulnerable to CVE-2017-17458. An attacker can exploit this issue if they can commit to a Mercurial repository linked in Sourcetree for Windows by adding a git subrepository specifying arbitrary code in the form of a .git/hooks/post-update script, allowing the attacker to execute arbitrary code on systems running a vulnerable version of Sourcetree for Windows.
      Sourcetree for Windows performs background indexing which allows for this issue to be exploited without a user needing to directly interact with the git subrepository. From version 1.4.0 of Sourcetree for Windows, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler.

      Affected versions:

      • Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability.

      Fix:

      Acknowledgements
      Atlassian would like to credit Zhang Tianqi @ Tophant for reporting this issue to us.

      For additional details see the full advisory.

            [SRCTREEWIN-8257] Mercurial: arbitrary command execution in mercurial repositories with a git submodule - CVE-2017-17458

            David Black made changes -
            Labels Original: CVE-2017-17458 advisory cvss-critical security New: CVE-2017-17458 advisory advisory-released cvss-critical security
            Monique Khairuliana (Inactive) made changes -
            Workflow Original: JAC Bug Workflow v3 [ 3453729 ] New: SRCTREE JAC Bug Workflow [ 3743351 ]
            Monique Khairuliana (Inactive) made changes -
            Workflow Original: SourceTree Bug Workflow [ 2494866 ] New: JAC Bug Workflow v3 [ 3453729 ]
            David Black made changes -
            Description Original: The embedded version of Mercurial used in Sourcetree for Windows was vulnerable to CVE-2017-17458. An attacker can exploit this issue if they can commit to a Mercurial repository linked in Sourcetree for Windows by adding a git subrepository specifying arbitrary code in the form of a .git/hooks/post-update script, allowing the attacker to execute arbitrary code on systems running a vulnerable version of Sourcetree for Windows.
            Sourcetree for Windows performs background indexing which allows for this issue to be exploited without a user needing to directly interact with the git subrepository. From version 1.4.0 of Sourcetree for Windows, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler.


            *Affected versions:*
            * Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability.


            *Fix:*
            * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from https://www.sourcetreeapp.com/ .


            *Acknowledgements*
            Atlassian would like to credit ZhangTianqi @ Tophant for reporting this issue to us.

            For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].             		New: The embedded version of Mercurial used in Sourcetree for Windows was vulnerable to CVE-2017-17458. An attacker can exploit this issue if they can commit to a Mercurial repository linked in Sourcetree for Windows by adding a git subrepository specifying arbitrary code in the form of a .git/hooks/post-update script, allowing the attacker to execute arbitrary code on systems running a vulnerable version of Sourcetree for Windows.
             Sourcetree for Windows performs background indexing which allows for this issue to be exploited without a user needing to directly interact with the git subrepository. From version 1.4.0 of Sourcetree for Windows, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler.

            *Affected versions:*
             * Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability.

            *Fix:*
             * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from [https://www.sourcetreeapp.com/] .

            *Acknowledgements*
             Atlassian would like to credit Zhang Tianqi @ Tophant for reporting this issue to us.

            For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].
            Security Metrics Bot made changes -
            Security Original: Reporter and Atlassian Staff [ 10751 ]
            David Black made changes -
            Description Original: The embedded version of Mercurial used in Sourcetree for Windows was vulnerable to CVE-2017-17458. An attacker can exploit this issue if they can commit to a Mercurial repository linked in Sourcetree for Windows by adding a git subrepository specifying arbitrary code in the form of a .git/hooks/post-update script, allowing the attacker to execute arbitrary code on systems running a vulnerable version of Sourcetree for Windows.
            Sourcetree for Windows performs background indexing which allows for this issue to be exploited without a user needing to directly interact with the git subrepository. From version 1.4.0 of Sourcetree for Windows, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler.


            *Affected versions:*
            * Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability.


            *Fix:*
            * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from https://www.sourcetreeapp.com/ .


            *Acknowledgements*
            Atlassian would like to credit ZhangTianqi @ Tophant for reporting this issue to us.

            For additional details see the full advisory.             		New: The embedded version of Mercurial used in Sourcetree for Windows was vulnerable to CVE-2017-17458. An attacker can exploit this issue if they can commit to a Mercurial repository linked in Sourcetree for Windows by adding a git subrepository specifying arbitrary code in the form of a .git/hooks/post-update script, allowing the attacker to execute arbitrary code on systems running a vulnerable version of Sourcetree for Windows.
            Sourcetree for Windows performs background indexing which allows for this issue to be exploited without a user needing to directly interact with the git subrepository. From version 1.4.0 of Sourcetree for Windows, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler.


            *Affected versions:*
            * Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability.


            *Fix:*
            * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from https://www.sourcetreeapp.com/ .


            *Acknowledgements*
            Atlassian would like to credit ZhangTianqi @ Tophant for reporting this issue to us.

            For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].
            David Black made changes -
            Link New: This issue is related to SRCTREE-5247 [ SRCTREE-5247 ]
            David Black made changes -
            Link New: This issue is related to SRCTREE-5246 [ SRCTREE-5246 ]
            David Black made changes -
            Link New: This issue relates to SRCTREEWIN-8119 [ SRCTREEWIN-8119 ]
            David Black made changes -
            Link New: This issue relates to SRCTREE-5244 [ SRCTREE-5244 ]

              Unassigned Unassigned
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: