Atlassian SourceTree CVE-2018-20234 Arbitrary Code Execution Vulnerability

Bugtraq ID:	107414
Class:	Unknown
CVE:	CVE-2018-20234
Remote:	Yes
Local:	No
Published:	Mar 08 2019 12:00AM
Updated:	Mar 08 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Atlassian SourceTree 3.0.15 Atlassian SourceTree 3.0.12 Atlassian SourceTree 3.0.10 Atlassian SourceTree 3.0.8 Atlassian SourceTree 2.5.1 Atlassian SourceTree 2.5 Atlassian SourceTree 1.5 Atlassian SourceTree 1.4 Atlassian SourceTree 2.6.10.0 Atlassian SourceTree 2.5C Atlassian SourceTree 2.0.20.1 Atlassian SourceTree 2.0.20.0 Atlassian SourceTree 1.9.13.7 Atlassian SourceTree 1.7.0.32509 Atlassian SourceTree 1.6 Atlassian SourceTree 1.3
Not Vulnerable:	Atlassian SourceTree 3.1.1

Atlassian SourceTree CVE-2018-20234 Arbitrary Code Execution Vulnerability

Atlassian SourceTree is prone to an arbitrary code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected system. Failed exploit attempts may cause a denial-of-service condition.

Versions prior to Sourcetree for macOS 3.1.1 are vulnerable.

Atlassian SourceTree CVE-2018-20234 Arbitrary Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Atlassian SourceTree CVE-2018-20234 Arbitrary Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Atlassian SourceTree CVE-2018-20234 Arbitrary Code Execution Vulnerability

References:

• Atlassian Homepage (Atlassian)
  
• SourceTree Homepage (Atlassian)
  
• Argument Injection via Mercurial hooks in Sourcetree for macOS - CVE-2018-20234 (Atlassian)
  
• March 2019 Sourcetree Advisory - Multiple Remote Code Execution Vulnerabilities ()