Atlassian Sourcetree for macOS Command Injection Vulnerability

Atlassian Sourcetree for macOS is a free Windows-based Git and Mercurial client tool from Atlassian Australia that manages repositories using a visual interface. A security vulnerability exists in Atlassian Sourcetree versions 1.0b2 through 2.7.0 excluding version 2.7.0 for macOS-based platforms...

CVE-2017-14592

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree...

CVE-2017-14593

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of...

CVE-2017-14593

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of...

CVE-2017-14592

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree...

Command injection

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of...

Command injection

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree...

CVE-2017-14593

Sourcetree for Windows is affected by CVE-2017-14593: multiple argument and command injection flaws in Mercurial and Git handling that can lead to arbitrary code execution. Vulnerable in versions starting at 0.5.1.0 up to (but not including) 2.4.7.0; from version 0.8.4b the issue can be triggered...

CVE-2017-14592

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree...

CVE-2017-14593

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of...

CVE-2017-14592

Sourcetree for macOS is affected by CVE-2017-14592: argument and command injection in Mercurial and Git repo handling, exploitable by a commit permission holder. From version 1.4.0 the issue can be triggered from a webpage via the Sourcetree URI handler. Affected releases are 1.0b2 through before...

CVE-2017-14593: Improper Neutralization of Special Elements used in a Command

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of...

PT-2018-5684

Name of the Vulnerable Software and Affected Versions: Sourcetree for macOS versions 1.0b2 through 2.7.0 Description: The issue affects the handling of Mercurial and Git repositories in Sourcetree for macOS, allowing an attacker with commit permission to a linked repository to exploit argument an...

CVE-2017-14592: Improper Neutralization of Special Elements used in a Command

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree...

PT-2018-5685

Name of the Vulnerable Software and Affected Versions: Sourcetree for Windows versions 0.5.1.0 through 2.4.7.0 excluding 2.4.7.0 Description: The issue affects the handling of Mercurial and Git repositories in Sourcetree for Windows, allowing an attacker with commit permission to a linked...

Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

The embedded version of Git LFS|https://git-lfs.github.com used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing...

Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

The embedded version of Git LFS|https://git-lfs.github.com used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing...

Authentication fails using SSH keys since 2.3.5

Neither the Pagent agent or OpenSSH is working to authenticate since I upgraded. Switching SSH services makes no difference. If I go to the command line, using ssh -i identfile I have no issues authenticating to any system. Other symptoms include the terminal not going to the repository but using...

Authentication fails using SSH keys since 2.3.5

Neither the Pagent agent or OpenSSH is working to authenticate since I upgraded. Switching SSH services makes no difference. If I go to the command line, using ssh -i identfile I have no issues authenticating to any system. Other symptoms include the terminal not going to the repository but using...

SourceTree Command Injection

The vulnerability of the visual Git client SourceTree exists because measures to neutralize special elements used in the operating system command are not taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by modifying the URL address...