October 2018 Sourcetree Advisory

Anton Black <ablack@xxxxxxxxxxxxx> · Thu, 1 Nov 2018 08:30:12 +1100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

This email refers to the advisory found at
https://confluence.atlassian.com/display/SOURCETREEKB/Sourcetree+Security+Advisory+2018-10-31
.

CVE ID:

* CVE-2018-13396.
* CVE-2018-13397.

Product: Sourcetree.

Affected Sourcetree product versions:

1.0b2 <= version < 3.0.0
0.5.1.0 <= version < 3.0.0

Fixed Sourcetree product versions:

* for macOS, Sourcetree 3.0.0 has been released with a fix for these issues.
* for Windows, Sourcetree 3.0.0 has been released with a fix for these issues.

Summary:
This advisory discloses critical severity security vulnerabilities. Versions of
Sourcetree are affected by these vulnerabilities.

Customers who have upgraded Sourcetree to version 3.0.0 (Sourcetree for macOS)
or 3.0.0 (Sourcetree for Windows) are not affected.

Customers who have downloaded and installed Sourcetree >= 1.0b2 but less than
3.0.0 (the fixed version for macOS) or who have downloaded and installed
Sourcetree >= 0.5.1.0 but less than 3.0.0 (the fixed version for
Windows), please
upgrade your Sourcetree installations immediately to fix these vulnerabilities.

Sourcetree for macOS - Git submodules vulnerability (CVE-2018-13396)

Severity:
Atlassian rates the severity level of this vulnerability as critical, according
to the scale published in our Atlassian severity levels. The scale allows us to
rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT
environment.

Description:

The embedded version of Git used in Sourcetree for macOS was vulnerable to
CVE-2018-13396. An attacker can exploit this issue if they can commit to a Git
repository linked in Sourcetree for macOS. This allows them to execute arbitrary
code on systems running a vulnerable version of Sourcetree for macOS.
Versions of Sourcetree for macOS starting with version 1.02b before version
3.0.0 are affected by this vulnerability. This issue can be tracked at:
https://jira.atlassian.com/browse/SRCTREE-5985 .

Sourcetree for Windows - Git submodules vulnerability (CVE-2018-13397)

Severity:
Atlassian rates the severity level of this vulnerability as critical, according
to the scale published in our Atlassian severity levels. The scale allows us to
rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT
environment.

Description:

The embedded version of Git used in Sourcetree for Windows was vulnerable to
CVE-2018-13397. An attacker can exploit this issue if they can commit to a Git
repository linked in Sourcetree for Windows. This allows them to execute
arbitrary code on systems running a vulnerable version of Sourcetree for
Windows.
Versions of Sourcetree for Windows starting with version 0.5.1.0 before version
3.0.0 are affected by this vulnerability. This issue can be tracked at:
https://jira.atlassian.com/browse/SRCTREEWIN-9077 .

Fix:

To address these issues, we've released the following versions containing a
fix:

* Sourcetree version 3.0.0 (Sourcetree for macOS)
* Sourcetree version 3.0.0 (Sourcetree for Windows)

Remediation:

Upgrade Sourcetree to version 3.0.0 (macOS or Windows) or higher.

The vulnerabilities and fix versions are described above. If affected, you
should upgrade to the latest version immediately.

For a full description of the latest version of Sourcetree, see
the release notes found at
https://product-downloads.atlassian.com/software/sourcetree/ReleaseNotes/Sourcetree_3.0.html
. You can download
the latest version of Sourcetree from the download centre found at
https://www.sourcetreeapp.com/ .

Acknowledgements:
Atlassian would like to credit Terry Zhang at Tophant for reporting these issues
to us.