May 2017 - SourceTree - Critical Security Advisory

This email refers to the advisory found at
https://confluence.atlassian.com/x/jW2xNQ .


CVE ID:

* CVE-2017-8768.

Product: SourceTree.

Affected SourceTree product versions:

* SourceTree for Mac 1.4.0 <= version < 2.5.1
* SourceTree for Windows 0.8.4b <= version < 2.0.20.1


Fixed SourceTree product versions:

* Versions of SourceTree for Mac equal to and above 2.5.1 contain a
fix for this issue.
* Versions of SourceTree for Windows equal to and above 2.0.20.1
contain a fix for this issue.

Summary:
This advisory discloses a critical security vulnerability in versions
of SourceTree for Mac starting with 1.4.0 but before 2.5.1 and
SourceTree for Windows starting with 0.8.4b but before 2.0.20.1.

Customers who have upgraded SourceTree for Mac to version 2.5.1 are
not affected.

Customers who have upgraded SourceTree for Windows to version 2.0.20.1
are not affected.

Customers who have downloaded and installed SourceTree for Mac
starting with 1.4.0 but before 2.5.1 (the fixed version for 2.5.x) or
who have downloaded and installed SourceTree for Windows starting with
0.8.4b but before 2.0.20.1 (the fixed version for 2.0.x) please
upgrade SourceTree to the latest version to fix this vulnerability.
Command Injection - CVE-2017-8768:

Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels. The
scale allows us to rank the severity as critical, high, moderate or
low.
This is our assessment and you should evaluate its applicability to
your own IT environment.


Description:

SourceTree for Mac and Windows are affected by a command injection
vulnerability in URI handling. The vulnerability can be triggered
through a browser or the SourceTree interface.
Versions of SourceTree for Mac starting with 1.4.0 but before 2.5.1
and versions of SourceTree for Windows starting with 0.8.4b but before
2.0.20.1 are affected by this vulnerability. The issue for SourceTree
for Mac can found at https://jira.atlassian.com/browse/SRCTREE-4738
and for SourceTree for Windows at
https://jira.atlassian.com/browse/SRCTREEWIN-7161 .

Remediation:

Upgrade SourceTree for Mac to version 2.5.1 or higher. Please note
that since SourceTree for Mac 2.5.0 Mac OSX 10.11 or later is
required.
Upgrade SourceTree for Windows to version 2.0.20.1 or higher.

For a full description of the latest version of SourceTree, see the
release notes for Mac
(https://www.sourcetreeapp.com/update/releasenotes/2.5.1.html) and for
Windows (https://www.sourcetreeapp.com/update/windows/ga/ReleaseNotes_2.0.20.1.html).
You can download the latest version of SourceTree from
https://www.sourcetreeapp.com/.


Acknowledgements:
Atlassian would like to credit Yu Hong for reporting this issue to us.


Support:
If you have questions or concerns regarding this advisory, please
raise a support request at https://support.atlassian.com/.