Sourcetree Security Advisory 2019-06-05
Sourcetree - RCE on Sourcetree for Windows - CVE-2019-11582
| 要約 | CVE-2019-11582 - RCE on Sourcetree for Windows |
|---|---|
| 勧告のリリース日 | 12:00 PM PDT (Pacific Time, -7 hours) |
| 製品 | Sourcetree for Windows |
Affected Sourcetree for Windows Versions | 0.5a <= version < 3.1.3 |
Fixed Sourcetree for Windows Versions | 3.1.3 |
| CVE ID | CVE-2019-11582 |
脆弱性の概要
This advisory discloses a critical severity security vulnerability which was introduced in version 0.5a of Sourcetree for Windows. Versions of Sourcetree for Windows starting with 0.5a before 3.1.3 are affected by this vulnerability.
Customers who have upgraded Sourcetree for Windows to version 3.1.3 are not affected.
Customers who have downloaded and installed Sourcetree for Windows all versions prior to 3.1.3.
Please upgrade your Sourcetree for Windows installations immediately to fix this vulnerability.
Sourcetree - RCE on Sourcetree for Windows - CVE-2019-11582
深刻度
アトラシアンはアトラシアンの深刻度レベルで公開されているスケールに従って、この脆弱性の深刻度レベルを重大として評価しています。このスケールによって、深刻度を重大、高度、中度、低度として評価できます。
これはアトラシアンの評価であり、お客様自身の IT 環境への適用性を評価する必要があります。
説明
There was a remote code execution vulnerability in Sourcetree for Windows via the URI handlers. A remote, unauthenticated attacker was required to convince a user to interact with a crafted URL in order to exploit the vulnerability. With user interaction, the attacker gained remote code execution on the target system.
All versions of Sourcetree for Windows before version 3.1.3 are affected by this vulnerability. This issue can be tracked here: SRCTREEWIN-11917 - Remote code execution vulnerability for Sourcetree for Windows - CVE-2019-11582.
謝辞
Terry Zhang at Tophant
修正
弊社ではこの問題に対応するために次の対応を行いました。
- Released Sourcetree for Windows version 3.1.3 that contains a fix for this issue.
必要なアクション
Atlassian recommends that you upgrade to the latest version. For a full description of the latest version of Sourcetree for Windows, see the release notes. Download the latest version of Sourcetree.
Upgrade Sourcetree for Windows to version 3.1.3 or higher.
問題の軽減策
Atlassian recommends upgrading Sourcetree for Windows to version 3.1.3 or higher. Alternatively, for lower versions, please uncheck the Use this version of Sourcetree for URI association option under Tools > Options.
サポート
この勧告に関してご質問や懸念がある場合は、https://support.atlassian.com/ja/ でサポート リクエストを作成してください。
参考
| セキュリティ バグの修正ポリシー | As per our new policy critical security bug fixes will be back ported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy. We will release new maintenance releases for the versions covered by the policy instead of binary patches. バイナリ パッチのリリースは終了しています。 |
| セキュリティの問題の重大度レベル | Atlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry-standard vulnerability metric. You can also learn more about CVSS at FIRST.org. |
| サポート終了ポリシー | サポート終了ポリシーは、製品によって異なります。詳細は、アトラシアンの「製品終了ポリシー」を参照してください。 |