Sourcetree Security Advisory 2018-07-18
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Sourcetree - Remote Code Execution vulnerabilities - CVE-2018-11235
Summary | CVE-2018-11235 - Git submodules vulnerability CVE-2018-13385 - Argument injection via Mercurial repository filenames in Sourcetree for macOS. CVE-2018-13386 - Argument injection via Mercurial repository filenames in Sourcetree for Windows. |
|---|---|
Advisory Release Date | 18 Jul 2018 10:00 AM PDT (Pacific Time, -7 hours) - |
Products | - Sourcetree for macOS - Sourcetree for Windows |
Affected Sourcetree Versions | - Sourcetree for macOS 1.0b2 <= version < 2.7.6 2.7.5, 2.7.4, 2.7.3, 2.7.2, 2.7.2b2, 2.7.1b2, 2.7.1b1, 2.4.7.0, 2.7, 2.7b3, 2.7b2, 2.7b1, 2.6.3, 2.6.2, 2.6.1, 2.6, 2.5.3, 2.5.2, 2.5.1, 2.5, 2.4.1, 2.4, 2.3.2, 2.3.1, 2.3, 2.2.4, 2.2.3, 2.2.2, 2.2.1, 2.2, 2.0.5.8, 2.0.5.7, 2.0.5.6, 2.0.5.5, 2.0.5.4, 2.0.5.2, 2.0.5, 2.0.4, 2.0.3, 2.0.2, 2.0.1, 2.1, 2.0.0, 1.9.8, 1.9.7, 1.9.5.2, 1.9.5.1, 1.9.6, 1.9.4.1, 1.9.5, 1.9.3.1, 1.9.4, 1.9.3, 1.9.2, 1.9.1, 1.8.3, 1.8.2, 1.8.0.3, 1.8.1, 1.8.0.2, 1.8.0.1, 1.9.0, 1.7.5, 1.7.4.1, 1.7.4, 1.7.3, 1.7.2, 1.7.1, 1.6.4.1, 1.6.2.2, 1.6.2.1, 1.6.3.1, 1.8.0, 1.6.2, 1.6.0, 1.6.0.1, 1.6.1, 1.6.0b3, 1.6.0b2, 1.6.0b1, 1.7.0, 1.5.7.1, 1.5.8, 1.5.7, 1.5.5.1, 1.5.6, 1.5.5, 1.5.4, 1.5.3, 1.5.2, 1.5.1, 1.5.0b1, 1.6, 1.4.4, 1.4.3, 1.4.1.1, 1.4.2, 1.4.0b1, 1.4.1, 1.3.4, 1.3.3, 1.5.0, 1.3.1.1, 1.3.0, 1.3.2, 1.3.0b3, 1.3.0b2, 1.4.0, 1.3.1, 1.3.0b1, 1.2.9.1, 1.2.9, 1.2.8.1, 1.2.8, 1.2.4, 1.2.3, 1.2.2, 1.2.1, 1.2 - Sourcetree for Windows 0.5.1.0 <= version < 2.6.9 2.5.5, 2.4.8.0, 2.4.7.0, 2.4.4-beta-0, 2.3.5.0, 2.3.1.0, 2.2.4.0, 2.1.7.0, 2.1.6-beta-0, 2.1.5-beta-0, 2.1.2.5, 2.1.4-beta-0, 2.1.2.4, 2.1.2.3, 2.0.12-beta-1, 1.10.23.1, 1.10.22.1, 1.10.21.1, 2.0.11-beta-1, 2.0.9-beta-1, 2.0.8-beta-1, 1.10.19.1, 1.10.20.1, 1.10.18.1, 1.10.15.4, 1.10.14-beta-2, 1.9.10.0, 1.9.9.20, 1.9.6.2, 1.9.7-beta-2, 1.9.7-beta-1, 1.9.6.1, 1.9.7-beta-0, 1.9.7, 1.9.6-beta-0, 1.9.6, 1.9.5.0, 1.9.4-beta-1, 1.9.4-beta-0, 1.10.0-alpha-1, 1.9.3-beta-1, 1.9.3-beta-0, 1.9.2-beta-1, 1.9.1-beta-1, 1.9.0-beta-5, 1.8.2.11, 1.8.2.3, 1.8.2.2, 1.8.3, 1.8.2, 1.8.1, 1.8.0.36401, 1.6.25, 1.6.24, 1.6.23, 1.6.22, 1.6.21, 1.6.20, 1.6.19, 1.6.18, 1.6.17, 1.6.16, 1.6.15004, 1.6.15003, 1.6.15001, 1.6.15, 1.6.14, 1.6.13002, 1.6.13001, 1.6.12002, 1.6.13, 1.6.12001, 1.6.12, 1.6.11, 1.6.10, 1.6.9, 1.6.9003, 1.6.9002, 1.6.9001, 1.6.8, 1.6.7, 1.6.6, 1.6.5, 1.7, 1.6.3, 1.6.4, 1.6.2, 1.6.1, 1.6, 1.5.2, 1.5.1, 1.4.1, 1.5.0, 1.4.0, 1.3.3, 1.3.2, 1.3.1, 1.3.0, 1.2.4, 1.2.3, 1.2.2, 1.2.1, 1.2.0, 1.1.1, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.1, 1.0.2, 1.0.1, 0.9.4, 0.9.2.3, 0.9.2.2, 0.9.3, 0.9.2.1, 0.9.2, 0.9.1.2, 0.9.1.1, 0.9.0.6b, 0.9.0.5b, 0.9.0.4b, 0.9.0.3b, 0.9.0.2b, 0.9.1, 0.9.0.1b, 0.8.5b, 0.8.4b, 0.8.3b, 0.8.2b, 0.8.1b, 1.0.0, 0.9b, 0.8b, 0.5.1.0 |
Fixed Sourcetree Versions | - Sourcetree for macOS version 2.7.6 and higher. - Sourcetree for Windows version 2.6.9 and higher. |
CVE ID(s) | - CVE-2018-11235 - CVE-2018-13385 - CVE-2018-13386 |
Summary of Vulnerabilities
This advisory discloses several critical severity security vulnerabilities:
Git submodules vulnerability, which exists in Sourcetree for macOS from version 1.0b2 before 2.7.4, and in Sourcetree for Windows versions 0.5.10 before 2.6.9.
Argument injection via Mercurial repository filenames vulnerability, which exists in Sourcetree for macOS before version 2.7.6, and in Sourcetree for Windows before version 2.6.9.
Customers who have upgraded to Sourcetree for macOS version 2.7.6 or Sourcetree for Windows version 2.6.9arenot affected.
Customers who have downloaded and installed Sourcetree for macOS before version 2.7.6 or Sourcetree for Windows before version 2.6.9 are affected.
Please upgrade yourSourcetree installationsimmediately to fix this vulnerability.
Git submodules vulnerability - CVE-2018-11235
Severity
Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT environment.
Description
The embedded version of Git used in Sourcetree for macOS and Windows was vulnerable to CVE-2018-11235. An attacker can exploit this issue if they can commit to a Git repository linked in Sourcetree for macOS or Sourcetree for Windows that has been recursively cloned or if a user interacts with a submodule. This allows them to execute arbitrary code on systems running a vulnerable version of Sourcetree for macOS or Sourcetree for Windows.
Versions of Sourcetree for macOS starting with version 1.0b2 before version 2.7.4 are affected by this vulnerability. This issue can be tracked at SRCTREE-5845 - Git submodules vulnerability - CVE-2018-11235.
Versions of Sourcetree for Windows starting with version 0.5.1.0 before version 2.6.9 are affected by this vulnerability. This issue can be tracked atSRCTREEWIN-8882 - Git submodules vulnerability - CVE-2018-11235.
Acknowledgements
CVE-2018-11235 was discovered by Etienne Stalmans.
Sourcetree for macOS - Argument injection via Mercurial repository filenames - CVE-2018-13385
Severity
Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT environment.
Description
There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.
Versions of Sourcetree for macOS before version 2.7.6 are affected by this vulnerability. This issue can be tracked at SRCTREE-5846 - Argument injection via Mercurial repository filenames - CVE-2018-13385.
Acknowledgements
Credit for finding this vulnerability goes to Terry Zhang at Tophant.
Sourcetree for Windows - Argument injection via Mercurial repository filenames - CVE-2018-13386
Severity
Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT environment.
Description
There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
Versions of Sourcetree for Windows before version 2.6.9 are affected by this vulnerability. This issue can be tracked at SRCTREEWIN-8884 - Argument injection via Mercurial repository filenames - CVE-2018-13386.
Acknowledgements
Credit for finding this vulnerability goes to Terry Zhang at Tophant.
Fix
We have taken the following steps to address these issues:
Released Sourcetree for macOS version 2.7.6 that contains fixes for these issues and can be downloaded from https://www.sourcetreeapp.com/.
Released Sourcetree for Windows version 2.6.9 that contains fixes for these issues and can be downloaded from https://www.sourcetreeapp.com/.
What You Need to Do
Atlassian recommends that you upgrade to the latest version. For a full description of the latest version of Sourcetree, see the release notes. You can download the latest version of Sourcetree from the Sourcetree website.
Upgrade to Sourcetree for macOS version 2.7.6, or Sourcetree for Windows version 2.6.9 or higher.
If you are running Sourcetree for macOS version < 2.7.6, or Sourcetree for Windows version < 2.6.9, and cannot upgrade to the latest version,then upgrade to Sourcetree for macOS version 2.7.6 or Sourcetree for Windows version 2.6.9 at a minimum.
Support
If you did not receive an email for this advisory and you wish to receive such emails in the future go to https://my.atlassian.com/email and subscribe to Alerts emails.
Atlassian supports Sourcetree through the Atlassian Community. If you have questions or concerns regarding this advisory, please raise them via https://community.atlassian.com/t5/Sourcetree/ct-p/Sourcetree.
References
As per our policy, critical security bug fixes will be back ported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy. | |
Atlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry standard vulnerability metric. You can also learn more about CVSS at FIRST.org. | |
Our end of life policy varies for different products. Please refer to our EOL Policy for details. |
Was this helpful?