Message-ID: <CALfaOcdCFAA0Jt=iKUpmhiD1zrC72MjhSCufSCvNEpD9-EfTAw@mail.gmail.com>
Date: Thu, 1 Nov 2018 08:30:12 +1100
From: Anton Black <ablack@...assian.com>
To: bugtraq@...urityfocus.com
Subject: October 2018 Sourcetree Advisory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

This email refers to the advisory found at
https://confluence.atlassian.com/display/SOURCETREEKB/Sourcetree+Security+Advisory+2018-10-31
.


CVE ID:

* CVE-2018-13396.
* CVE-2018-13397.


Product: Sourcetree.

Affected Sourcetree product versions:

1.0b2 <= version < 3.0.0
0.5.1.0 <= version < 3.0.0


Fixed Sourcetree product versions:

* for macOS, Sourcetree 3.0.0 has been released with a fix for these issues.
* for Windows, Sourcetree 3.0.0 has been released with a fix for these issues.


Summary:
This advisory discloses critical severity security vulnerabilities. Versions of
Sourcetree are affected by these vulnerabilities.



Customers who have upgraded Sourcetree to version 3.0.0 (Sourcetree for macOS)
or 3.0.0 (Sourcetree for Windows) are not affected.

Customers who have downloaded and installed Sourcetree >= 1.0b2 but less than
3.0.0 (the fixed version for macOS) or who have downloaded and installed
Sourcetree >= 0.5.1.0 but less than 3.0.0 (the fixed version for
Windows), please
upgrade your Sourcetree installations immediately to fix these vulnerabilities.



Sourcetree for macOS - Git submodules vulnerability (CVE-2018-13396)

Severity:
Atlassian rates the severity level of this vulnerability as critical, according
to the scale published in our Atlassian severity levels. The scale allows us to
rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT
environment.


Description:

The embedded version of Git used in Sourcetree for macOS was vulnerable to
CVE-2018-13396. An attacker can exploit this issue if they can commit to a Git
repository linked in Sourcetree for macOS. This allows them to execute arbitrary
code on systems running a vulnerable version of Sourcetree for macOS.
Versions of Sourcetree for macOS starting with version 1.02b before version
3.0.0 are affected by this vulnerability. This issue can be tracked at:
https://jira.atlassian.com/browse/SRCTREE-5985 .

Sourcetree for Windows - Git submodules vulnerability (CVE-2018-13397)

Severity:
Atlassian rates the severity level of this vulnerability as critical, according
to the scale published in our Atlassian severity levels. The scale allows us to
rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT
environment.


Description:

The embedded version of Git used in Sourcetree for Windows was vulnerable to
CVE-2018-13397. An attacker can exploit this issue if they can commit to a Git
repository linked in Sourcetree for Windows. This allows them to execute
arbitrary code on systems running a vulnerable version of Sourcetree for
Windows.
Versions of Sourcetree for Windows starting with version 0.5.1.0 before version
3.0.0 are affected by this vulnerability. This issue can be tracked at:
https://jira.atlassian.com/browse/SRCTREEWIN-9077 .



Fix:

To address these issues, we've released the following versions containing a
fix:

* Sourcetree version 3.0.0 (Sourcetree for macOS)
* Sourcetree version 3.0.0 (Sourcetree for Windows)

Remediation:

Upgrade Sourcetree to version 3.0.0 (macOS or Windows) or higher.

The vulnerabilities and fix versions are described above. If affected, you
should upgrade to the latest version immediately.


For a full description of the latest version of Sourcetree, see
the release notes found at
https://product-downloads.atlassian.com/software/sourcetree/ReleaseNotes/Sourcetree_3.0.html
. You can download
the latest version of Sourcetree from the download centre found at
https://www.sourcetreeapp.com/ .

Acknowledgements:
Atlassian would like to credit Terry Zhang at Tophant for reporting these issues
to us.



-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEXh3qw5vbMx/VSutRJCCXorxSdqAFAlvaHbQACgkQJCCXorxS
dqDfQBAAna3i7bxPHk7WrmfoZi08GjxlfWwaLNlEQooILsCXxRyiZjvCi722Et2t
OoaH5W0CerizN8edElN+nGFnHHdjKiFnXH7v20f8Ua51Ye05huA63U8CvBBdIkjZ
XAXRpfGQkTtnkI6nQE5wxr2AEqb+tL6eOk4Qt9WyQkP1/51RobOjkz4k/+NbGw9c
HgLrO918u4HsltlHcr4/m8yGmg7qrth2Rcoa8OQg/JaDtLf+Omj7IohpaBtRcI7g
B+ilyuY0LSDk2pIil2LTRP1klV7cVFJ3mhq4nzugxGju37h4O5hOVMvT/LJ+1uo+
Yuw7Lb9yr9BcZoRXJC45btzWMGXWMNnDk0HsZe1WBJoyzs0tg9aUgHZ8cDFPZFsH
mdt1QjMP7WrhyDnoyxrkDjlm79VE/jYP5q6sFs5W0LgCaCCVWXkZf1OI3JdoNs1V
L3SMsmOPyMpMpMlcscLgTUn/GxIeCbXUq2SjxNVGklufz5/t0MSSAN23ZbsgGen/
DX0M5BQxV9UdLLt2SmXHjI/pspXKyWAk5MOYmK68kkMdvImLPfEmvGaRxS8qlhNx
b5RhyxGtCANBFQPR2Sn4HRDIZYk1tvnNlynUgMK8dvgsqf2FprngIPT1NcMAolhl
sJGBPYMG+Hy3NBiYPLy3hS3UIOExsoS+Q7vnC1iNj1p9eOEPM2A=
=D+B5
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists