[SRCTREEWIN-8509] Argument injection via Mercurial tag names on Windows - CVE-2018-5226 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Highest
Fix Version/s: 2.5.5
Affects Version/s: None
Component/s: Mercurial
Labels:
- CVE-2018-5226
- advisory
- cvss-critical
- rce
- security

Symptom Severity:
Severity 1 - Critical

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.

Affected versions:

All versions of SourceTree for Windows before version 2.5.5.0

Fix:

Upgrade SourceTree for Windows to version 2.5.5.0 or higher from https://www.sourcetreeapp.com/

Acknowledgements
Atlassian would like to credit Zhang Tianqi @ Tophant for reporting this issue to us.

For additional details see the full advisory.

mentioned in: Page Failed to load; Page Failed to load

relates to: SECENG-1459 Failed to load

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Matt Hart (Inactive)

Affected customers:: 0 This affects my team

Watchers:: 2 Start watching this issue

Created:: 04/Apr/2018 1:58 AM

Updated:: 26/Aug/2019 5:15 AM

Resolved:: 04/Apr/2018 2:14 AM

Sourcetree for Windows

Details

Description

Attachments

Issue Links

Forms

Activity

[SRCTREEWIN-8509] Argument injection via Mercurial tag names on Windows - CVE-2018-5226

People

Dates