Allele Security Alert
ASA-2019-00127
Identifier(s)
ASA-2019-00127, CVE-2018-20234, CVE-2018-20235
Title
Argument injection via mercurial hooks
Vendor(s)
Atlassian
Product(s)
Sourcetree
Affected version(s)
Sourcetree for macOS starting with 1.2 before version 3.1.1
Sourcetree for Windows starting with 0.5a before version 3.0.15
Fixed version(s)
Sourcetree for macOS version 3.1.1
Sourcetree for Windows version 3.0.15
Proof of concept
Unknown
Description
Sourcetree for macOS before version 3.1.1 and Sourcetree for Windows before version 3.0.15 were vulnerable to CVE-2018-20234 and CVE-2018-20235 respectively. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS or Windows is able to exploit this issue to gain code execution on the system.
Technical details
Unknown
Credits
Terry Zhang (Tophant)
Reference(s)
Sourcetree Security Advisory 2019-03-06
https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2019-03-06-966678691.html
Argument Injection via Mercurial hooks in Sourcetree for macOS – CVE-2018-20234
https://jira.atlassian.com/browse/SRCTREE-6391
Argument Injection via Mercurial hooks in Sourcetree for Windows – CVE-2018-20235
https://jira.atlassian.com/browse/SRCTREEWIN-11289
CVE-2018-20234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20234
CVE-2018-20234
https://nvd.nist.gov/vuln/detail/CVE-2018-20234
CVE-2018-20235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20235
CVE-2018-20235
https://nvd.nist.gov/vuln/detail/CVE-2018-20235
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: March 12, 2019