Sourcetree Security Advisory 2018-10-31

Related content

  • No related content found

Still need help?

The Atlassian Community is here for you.

Ask the community

Sourcetree - Remote Code Execution vulnerabilities - CVE-2018-13396

Summary

CVE-2018-13396 - Argument injection via Mercurial repository with Git subrepository in Sourcetree for macOS.

CVE-2018-13397 - Argument injection via Mercurial repository with Git subrepository in Sourcetree for Windows.

Advisory Release Date

 10:00 AM PDT (Pacific Time, -7 hours)

Products
  • Sourcetree for macOS
  • Sourcetree for Windows

Affected Sourcetree Versions

  • Sourcetree for macOS 1.0b2 <= version < 3.0.0

    Click here to expand...

    2.7.5
    2.7.4
    2.7.3
    2.7.2
    2.7.2b2
    2.7.1b2
    2.7.1b1
    2.4.7.0
    2.7
    2.7b3
    2.7b2
    2.7b1
    2.6.3
    2.6.2
    2.6.1
    2.6
    2.5.3
    2.5.2
    2.5.1
    2.5
    2.4.1
    2.4
    2.3.2
    2.3.1
    2.3
    2.2.4
    2.2.3
    2.2.2
    2.2.1
    2.2
    2.0.5.8
    2.0.5.7
    2.0.5.6
    2.0.5.5
    2.0.5.4
    2.0.5.2
    2.0.5
    2.0.4
    2.0.3
    2.0.2
    2.0.1
    2.1
    2.0.0
    1.9.8
    1.9.7
    1.9.5.2
    1.9.5.1
    1.9.6
    1.9.4.1
    1.9.5
    1.9.3.1
    1.9.4
    1.9.3
    1.9.2
    1.9.1
    1.8.3
    1.8.2
    1.8.0.3
    1.8.1
    1.8.0.2
    1.8.0.1
    1.9.0
    1.7.5
    1.7.4.1
    1.7.4
    1.7.3
    1.7.2
    1.7.1
    1.6.4.1
    1.6.2.2
    1.6.2.1
    1.6.3.1
    1.8.0
    1.6.2
    1.6.0
    1.6.0.1
    1.6.1
    1.6.0b3
    1.6.0b2
    1.6.0b1
    1.7.0
    1.5.7.1
    1.5.8
    1.5.7
    1.5.5.1
    1.5.6
    1.5.5
    1.5.4
    1.5.3
    1.5.2
    1.5.1
    1.5.0b1
    1.6
    1.4.4
    1.4.3
    1.4.1.1
    1.4.2
    1.4.0b1
    1.4.1
    1.3.4
    1.3.3
    1.5.0
    1.3.1.1
    1.3.0
    1.3.2
    1.3.0b3
    1.3.0b2
    1.4.0
    1.3.1
    1.3.0b1
    1.2.9.1
    1.2.9
    1.2.8.1
    1.2.8
    1.2.4
    1.2.3
    1.2.2
    1.2.1
    1.2

  • Sourcetree for Windows 0.5.1.0 <= version < 3.0.0
    Click here to expand...

    2.6.9.0
    2.5.5.0
    2.4.8.0
    2.4.7.0
    2.4.4-beta-0
    2.3.5.0
    2.3.1.0
    2.2.4.0
    2.1.7.0
    2.1.6-beta-0
    2.1.5-beta-0
    2.1.2.5
    2.1.4-beta-0
    2.1.2.4
    2.1.2.3
    2.0.12-beta-1
    1.10.23.1
    1.10.22.1
    1.10.21.1
    2.0.11-beta-1
    2.0.9-beta-1
    2.0.8-beta-1
    1.10.19.1
    1.10.20.1
    1.10.18.1
    1.10.15.4
    1.10.14-beta-2
    1.9.10.0
    1.9.9.20
    1.9.6.2
    1.9.7-beta-2
    1.9.7-beta-1
    1.9.6.1
    1.9.7-beta-0
    1.9.7
    1.9.6-beta-0
    1.9.6
    1.9.5.0
    1.9.4-beta-1
    1.9.4-beta-0
    1.10.0-alpha-1
    1.9.3-beta-1
    1.9.3-beta-0
    1.9.2-beta-1
    1.9.1-beta-1
    1.9.0-beta-5
    1.8.2.11
    1.8.2.3
    1.8.2.2
    1.8.3
    1.8.2
    1.8.1
    1.8.0.36401
    1.6.25
    1.6.24
    1.6.23
    1.6.22
    1.6.21
    1.6.20
    1.6.19
    1.6.18
    1.6.17
    1.6.16
    1.6.15004
    1.6.15003
    1.6.15001
    1.6.15
    1.6.14
    1.6.13002
    1.6.13001
    1.6.12002
    1.6.13
    1.6.12001
    1.6.12
    1.6.11
    1.6.10
    1.6.9
    1.6.9003
    1.6.9002
    1.6.9001
    1.6.8
    1.6.7
    1.6.6
    1.6.5
    1.7
    1.6.3
    1.6.4
    1.6.2
    1.6.1
    1.6
    1.5.2
    1.5.1
    1.4.1
    1.5.0
    1.4.0
    1.3.3
    1.3.2
    1.3.1
    1.3.0
    1.2.4
    1.2.3
    1.2.2
    1.2.1
    1.2.0
    1.1.1
    1.0.8
    1.0.7
    1.0.6
    1.0.5
    1.0.4
    1.0.3
    1.1
    1.0.2
    1.0.1
    0.9.4
    0.9.2.3
    0.9.2.2
    0.9.3
    0.9.2.1
    0.9.2
    0.9.1.2
    0.9.1.1
    0.9.0.6b
    0.9.0.5b
    0.9.0.4b
    0.9.0.3b
    0.9.0.2b
    0.9.1
    0.9.0.1b
    0.8.5b
    0.8.4b
    0.8.3b
    0.8.2b
    0.8.1b
    1.0.0
    0.9b
    0.8b
    0.5.1.0

Fixed Sourcetree Versions

  • Sourcetree for macOS version 3.0.0 and higher.
  • Sourcetree for Windows version 3.0.0 and higher.
CVE ID(s)

CVE-2018-13396

CVE-2018-13397

Summary of vulnerabilities

This advisory discloses a critical severity security vulnerability: the Git subrepository in Mercurial repository vulnerability, which exists in Sourcetree for macOS from version 1.0b2 before 3.0.0, and in Sourcetree for Windows from version 0.5.10 before 3.0.0.

Customers who have upgraded to Sourcetree for macOS version 3.0.0 or Sourcetree for Windows version 3.0.0 are not affected.

Customers who have downloaded and installed Sourcetree for macOS before version 3.0.0 or Sourcetree for Windows before version 3.0.0 are affected.

Please upgrade your Sourcetree installations immediately to fix this vulnerability.

Git submodules vulnerability - CVE-2018-13396 and CVE-2018-13397

Severity

We rate the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. This is our assessment and you should evaluate its applicability to your own IT environment.

Description

Sourcetree for macOS and Windows before version 3.0.0 were vulnerable to CVE-2018-13396 and CVE-2018-13397 respectively. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS or Windows is able to exploit this issue to gain code execution on the system.

Versions of Sourcetree for macOS starting with version 1.0b2 before version 3.0.0 are affected by this vulnerability. You can track this issue at  SRCTREE-5985 - Getting issue details... STATUS .

Versions of Sourcetree for Windows starting with version 0.5.1.0 before version 3.0.0 are affected by this vulnerability. You can track this issue at  SRCTREEWIN-9077 - Getting issue details... STATUS .

Acknowledgements

Credit for finding this vulnerability goes to Terry Zhang at Tophant.

Fix

We have taken the following steps to address these issues:

  1. Released Sourcetree for macOS version 3.0.0 that contains fixes for these issues, and can be downloaded from https://www.sourcetreeapp.com/.
  2. Released Sourcetree for Windows version 3.0.0 that contains fixes for these issues, and can be downloaded from https://www.sourcetreeapp.com/.

What you need to do

We recommend you upgrade to the latest version. For a full description of the latest version of Sourcetree, see the release notes. You can download the latest version of Sourcetree from the Sourcetree website.

Upgrade to Sourcetree for macOS version 3.0.0, or Sourcetree for Windows version 3.0.0 or higher.

Support

If you didn't receive an email for this advisory and you wish to receive such emails in the future, go to https://my.atlassian.com/email and subscribe to alerts emails.

We support Sourcetree through the Atlassian Community. If you have questions or concerns regarding this advisory, please raise them via https://community.atlassian.com/t5/Sourcetree/ct-p/Sourcetree.

References

Security Bug fix Policy

As per our policy, critical security bug fixes will be backported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy. 

Severity Levels for security issuesAtlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry standard vulnerability metric. You can also learn more about CVSS at FIRST.org.
End of Life Policy Our end of life policy varies for different products. Please refer to our EOL Policy for details. 
Last modified on Nov 2, 2018

Was this helpful?

Yes
No
Provide feedback about this article

Related content

  • No related content found
Powered by Confluence and Scroll Viewport.