• Type: Bug
• Resolution: Fixed
• Priority: Highest
• Fix Version/s: 2.4.7.0
• Affects Version/s: None
• Component/s: None
• Labels:

  • CVE-2017-17831
  • advisory
  • advisory-released
  • command-injection
  • cvss-critical
  • security

[SRCTREEWIN-8261] Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

David Black made changes - 13/Nov/2019 11:50 PM

Labels

Original: CVE-2017-17831 advisory cvss-critical security

New: CVE-2017-17831 advisory advisory-released command-injection cvss-critical security

Monique Khairuliana (Inactive) made changes - 30/Sep/2019 4:23 AM

Workflow

Original: JAC Bug Workflow v3 [ 3453757 ]

New: SRCTREE JAC Bug Workflow [ 3744382 ]

Monique Khairuliana (Inactive) made changes - 26/Aug/2019 5:15 AM

Workflow

Original: SourceTree Bug Workflow [ 2495485 ]

New: JAC Bug Workflow v3 [ 3453757 ]

Security Metrics Bot made changes - 24/Jan/2018 5:52 PM

Security

Original: Reporter and Atlassian Staff [ 10751 ]

David Black made changes - 09/Jan/2018 1:23 AM

Description

Original: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for Windows was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for Windows by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems a running a vulnerable version of Sourcetree for Windows. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler. *Affected versions:* * Versions of Sourcetree for Windows starting with 1.7.0 before version 2.4.7.0 are affected by this vulnerability. *Fix:* * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from https://www.sourcetreeapp.com/ . For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].

New: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for Windows was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for Windows by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems running a vulnerable version of Sourcetree for Windows. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler. *Affected versions:* * Versions of Sourcetree for Windows starting with 1.7.0 before version 2.4.7.0 are affected by this vulnerability. *Fix:* * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from https://www.sourcetreeapp.com/ . For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].

David Black made changes - 03/Jan/2018 4:37 AM

Fix Version/s

New: 2.4.7.0 [ 77427 ]

David Black made changes - 03/Jan/2018 4:37 AM

Remote Link

New: This issue links to "SECENG-971 (Security JIRA (CYBER/J))" [ 342143 ]

David Black made changes - 21/Dec/2017 11:20 PM

Description

Original: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for Windows was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for Windows by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems a running a vulnerable version of Sourcetree for Windows. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler. *Affected versions:* * Versions of Sourcetree for Windows starting with 1.7.0 before version 2.4.7.0 are affected by this vulnerability. *Fix:* * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from https://www.sourcetreeapp.com/ . For additional details see the full advisory.

New: The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for Windows was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for Windows by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems a running a vulnerable version of Sourcetree for Windows. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler. *Affected versions:* * Versions of Sourcetree for Windows starting with 1.7.0 before version 2.4.7.0 are affected by this vulnerability. *Fix:* * Upgrade Sourcetree for Windows to version 2.4.7.0 or higher from https://www.sourcetreeapp.com/ . For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].

David Black made changes - 21/Dec/2017 11:17 PM

Link

New: This issue relates to SRCTREE-5246 [ SRCTREE-5246 ]

David Black made changes - 21/Dec/2017 11:17 PM

Link

Original: This issue is cloned from SRCTREE-5246 [ SRCTREE-5246 ]

Load more older events