Sourcetree Security Advisory 2018-10-31
Platform Notice: Server only. This article only applies to Atlassian products on the Server platform.
サーバー*製品のサポートは 2024 年 2 月 15 日に終了しました。サーバー製品を利用している場合は、アトラシアンのサーバー製品のサポート終了のお知らせページにて移行オプションをご確認ください。
*Fisheye および Crucible は除く
Sourcetree - Remote Code Execution vulnerabilities - CVE-2018-13396
| 要約 | CVE-2018-13396 - Argument injection via Mercurial repository with Git subrepository in Sourcetree for macOS. CVE-2018-13397 - Argument injection via Mercurial repository with Git subrepository in Sourcetree for Windows. |
|---|---|
| 勧告のリリース日 | 31 Oct 2018 10:00 AM PDT (Pacific Time, -7 hours) |
| 製品 | - Sourcetree for macOS - Sourcetree for Windows |
Affected Sourcetree Versions | - Sourcetree for macOS 1.0b2 <= version < 3.0.0 2.7.5, 2.7.4, 2.7.3, 2.7.2, 2.7.2b2, 2.7.1b2, 2.7.1b1, 2.4.7.0, 2.7, 2.7b3, 2.7b2, 2.7b1, 2.6.3, 2.6.2, 2.6.1, 2.6, 2.5.3, 2.5.2, 2.5.1, 2.5, 2.4.1, 2.4, 2.3.2, 2.3.1, 2.3, 2.2.4, 2.2.3, 2.2.2, 2.2.1, 2.2, 2.0.5.8, 2.0.5.7, 2.0.5.6, 2.0.5.5, 2.0.5.4, 2.0.5.2, 2.0.5, 2.0.4, 2.0.3, 2.0.2, 2.0.1, 2.1, 2.0.0, 1.9.8, 1.9.7, 1.9.5.2, 1.9.5.1, 1.9.6, 1.9.4.1, 1.9.5, 1.9.3.1, 1.9.4, 1.9.3, 1.9.2, 1.9.1, 1.8.3, 1.8.2, 1.8.0.3, 1.8.1, 1.8.0.2, 1.8.0.1, 1.9.0, 1.7.5, 1.7.4.1, 1.7.4, 1.7.3, 1.7.2, 1.7.1, 1.6.4.1, 1.6.2.2, 1.6.2.1, 1.6.3.1, 1.8.0, 1.6.2, 1.6.0, 1.6.0.1, 1.6.1, 1.6.0b3, 1.6.0b2, 1.6.0b1, 1.7.0, 1.5.7.1, 1.5.8, 1.5.7, 1.5.5.1, 1.5.6, 1.5.5, 1.5.4, 1.5.3, 1.5.2, 1.5.1, 1.5.0b1, 1.6, 1.4.4, 1.4.3, 1.4.1.1, 1.4.2, 1.4.0b1, 1.4.1, 1.3.4, 1.3.3, 1.5.0, 1.3.1.1, 1.3.0, 1.3.2, 1.3.0b3, 1.3.0b2, 1.4.0, 1.3.1, 1.3.0b1, 1.2.9.1, 1.2.9, 1.2.8.1, 1.2.8, 1.2.4, 1.2.3, 1.2.2, 1.2.1, 1.2. - Sourcetree for Windows 0.5.1.0 <= version < 3.0.0 2.6.9.0, 2.5.5.0, 2.4.8.0, 2.4.7.0, 2.4.4-beta-0, 2.3.5.0, 2.3.1.0, 2.2.4.0, 2.1.7.0, 2.1.6-beta-0, 2.1.5-beta-0, 2.1.2.5, 2.1.4-beta-0, 2.1.2.4, 2.1.2.3, 2.0.12-beta-1, 1.10.23.1, 1.10.22.1, 1.10.21.1, 2.0.11-beta-1, 2.0.9-beta-1, 2.0.8-beta-1, 1.10.19.1, 1.10.20.1, 1.10.18.1, 1.10.15.4, 1.10.14-beta-2, 1.9.10.0, 1.9.9.20, 1.9.6.2, 1.9.7-beta-2, 1.9.7-beta-1, 1.9.6.1, 1.9.7-beta-0, 1.9.7, 1.9.6-beta-0, 1.9.6, 1.9.5.0, 1.9.4-beta-1, 1.9.4-beta-0, 1.10.0-alpha-1, 1.9.3-beta-1, 1.9.3-beta-0, 1.9.2-beta-1, 1.9.1-beta-1, 1.9.0-beta-5, 1.8.2.11, 1.8.2.3, 1.8.2.2, 1.8.3, 1.8.2, 1.8.1, 1.8.0.36401, 1.6.25, 1.6.24, 1.6.23, 1.6.22, 1.6.21, 1.6.20, 1.6.19, 1.6.18, 1.6.17, 1.6.16, 1.6.15004, 1.6.15003, 1.6.15001, 1.6.15, 1.6.14, 1.6.13002, 1.6.13001, 1.6.12002, 1.6.13, 1.6.12001, 1.6.12, 1.6.11, 1.6.10, 1.6.9, 1.6.9003, 1.6.9002, 1.6.9001, 1.6.8, 1.6.7, 1.6.6, 1.6.5, 1.7, 1.6.3, 1.6.4, 1.6.2, 1.6.1, 1.6, 1.5.2, 1.5.1, 1.4.1, 1.5.0, 1.4.0, 1.3.3, 1.3.2, 1.3.1, 1.3.0, 1.2.4, 1.2.3, 1.2.2, 1.2.1, 1.2.0, 1.1.1, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.1, 1.0.2, 1.0.1, 0.9.4, 0.9.2.3, 0.9.2.2, 0.9.3, 0.9.2.1, 0.9.2, 0.9.1.2, 0.9.1.1, 0.9.0.6b, 0.9.0.5b, 0.9.0.4b, 0.9.0.3b, 0.9.0.2b, 0.9.1, 0.9.0.1b, 0.8.5b, 0.8.4b, 0.8.3b, 0.8.2b, 0.8.1b, 1.0.0, 0.9b, 0.8b, 0.5.1.0 |
Fixed Sourcetree Versions | - Sourcetree for macOS version 3.0.0 and higher. - Sourcetree for Windows version 3.0.0 and higher. |
| CVE ID | - CVE-2018-13396 - CVE-2018-13397 |
Summary of vulnerabilities
This advisory discloses a critical severity security vulnerability: the Git subrepository in Mercurial repository vulnerability, which exists in Sourcetree for macOS from version 1.0b2 before 3.0.0, and in Sourcetree for Windows from version 0.5.10 before 3.0.0.
Customers who have upgraded to Sourcetree for macOS version 3.0.0 or Sourcetree for Windows version 3.0.0 are not affected.
Customers who have downloaded and installed Sourcetree for macOS before version 3.0.0 or Sourcetree for Windows before version 3.0.0 are affected.
Please upgrade your Sourcetree installations immediately to fix this vulnerability.
Git submodules vulnerability - CVE-2018-13396 and CVE-2018-13397
深刻度
We rate the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. This is our assessment and you should evaluate its applicability to your own IT environment.
説明
Sourcetree for macOS and Windows before version 3.0.0 were vulnerable to CVE-2018-13396 and CVE-2018-13397 respectively. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS or Windows is able to exploit this issue to gain code execution on the system.
Versions of Sourcetree for macOS starting with version 1.0b2 before version 3.0.0 are affected by this vulnerability. You can track this issue at SRCTREE-5985 - Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo - CVE-2018-13396.
Versions of Sourcetree for Windows starting with version 0.5.1.0 before version 3.0.0 are affected by this vulnerability. You can track this issue at SRCTREEWIN-9077 - Remote Code Execution in Sourcetree for Windows, via Mercurial repo with Git subrepo - CVE-2018-13397.
謝辞
Credit for finding this vulnerability goes to Terry Zhang at Tophant.
修正
弊社ではこれらの課題に対応するために次の対応を行いました。
- Released Sourcetree for macOS version 3.0.0 that contains fixes for these issues, and can be downloaded from https://www.sourcetreeapp.com/.
- Released Sourcetree for Windows version 3.0.0 that contains fixes for these issues, and can be downloaded from https://www.sourcetreeapp.com/.
What you need to do
We recommend you upgrade to the latest version. For a full description of the latest version of Sourcetree, see the release notes. You can download the latest version of Sourcetree from the Sourcetree website.
Upgrade to Sourcetree for macOS version 3.0.0, or Sourcetree for Windows version 3.0.0 or higher.
サポート
If you didn't receive an email for this advisory and you wish to receive such emails in the future, go to https://my.atlassian.com/email and subscribe to alerts emails.
We support Sourcetree through the Atlassian Community. If you have questions or concerns regarding this advisory, please raise them via https://community.atlassian.com/t5/Sourcetree/ct-p/Sourcetree.
参考
| セキュリティ バグの修正ポリシー | As per our policy, critical security bug fixes will be backported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy. |
| セキュリティの問題の重大度レベル | アトラシアンのセキュリティ勧告には重大度レベルと CVE ID が含まれます。重大度レベルは、それぞれの脆弱性についてアトラシアンが独自に計算した CVSS スコアに基づきます。CVSS は業界標準の脆弱性メトリックです。CVSS の詳細を FIRST.org でご確認ください。 |
| サポート終了ポリシー | サポート終了ポリシーは、製品によって異なります。詳細は、アトラシアンの「製品終了ポリシー」を参照してください。 |