cnvd - cnvd-2019-09132

cnvd-2019-09132

Vulnerability from cnvd

Title: Sourcetree for macOS参数注入漏洞（CNVD-2019-09132）

Description:

Sourcetree是一款适用于Windows和Mac的免费Mercurial 和Git客户端。

Sourcetree for macOS存在参数注入漏洞，攻击者可通过Mercurial存储库中的Git子存储库利用该漏洞在系统上执行代码。

Severity: 高

Patch Name: Sourcetree for macOS参数注入漏洞（CNVD-2019-09132）的补丁

Patch Description:

Sourcetree是一款适用于Windows和Mac的免费Mercurial 和Git客户端。

Sourcetree for macOS存在参数注入漏洞，攻击者可通过Mercurial存储库中的Git子存储库利用该漏洞在系统上执行代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.sourcetreeapp.com/

Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13396

Impacted products

Name
Atlassian Sourcetree for macOS >=1.0b2，<=3.0.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-13396"
    }
  },
  "description": "Sourcetree\u662f\u4e00\u6b3e\u9002\u7528\u4e8eWindows\u548cMac\u7684\u514d\u8d39Mercurial \u548cGit\u5ba2\u6237\u7aef\u3002\n\nSourcetree for macOS\u5b58\u5728\u53c2\u6570\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7Mercurial\u5b58\u50a8\u5e93\u4e2d\u7684Git\u5b50\u5b58\u50a8\u5e93\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4ee3\u7801\u3002",
  "discovererName": "Anton Black",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.sourcetreeapp.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-09132",
  "openTime": "2019-04-04",
  "patchDescription": "Sourcetree\u662f\u4e00\u6b3e\u9002\u7528\u4e8eWindows\u548cMac\u7684\u514d\u8d39Mercurial \u548cGit\u5ba2\u6237\u7aef\u3002\r\n\r\nSourcetree for macOS\u5b58\u5728\u53c2\u6570\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7Mercurial\u5b58\u50a8\u5e93\u4e2d\u7684Git\u5b50\u5b58\u50a8\u5e93\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Sourcetree for macOS\u53c2\u6570\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2019-09132\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Atlassian Sourcetree for macOS \u003e=1.0b2\uff0c\u003c=3.0.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-13396",
  "serverity": "\u9ad8",
  "submitTime": "2018-11-06",
  "title": "Sourcetree for macOS\u53c2\u6570\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2019-09132\uff09"
}

CVE-2018-13396 (GCVE-0-2018-13396)

Vulnerability from cvelistv5

Published

2018-11-05 22:00

Modified

2024-09-16 21:03

Severity ?

CWE

Argument Injection

Summary

There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.

References

▼	URL	Tags
	https://jira.atlassian.com/browse/SRCTREE-5985	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Atlassian	Sourcetree for macOS	Version: 1.0b2 < unspecified Version: unspecified < 3.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:00:35.267Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/SRCTREE-5985"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sourcetree for macOS",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "1.0b2",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-10-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Argument Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-05T21:57:02",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://jira.atlassian.com/browse/SRCTREE-5985"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "DATE_PUBLIC": "2018-10-31T00:00:00",
          "ID": "CVE-2018-13396",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Sourcetree for macOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "1.0b2"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Atlassian"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Argument Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/SRCTREE-5985",
              "refsource": "CONFIRM",
              "url": "https://jira.atlassian.com/browse/SRCTREE-5985"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2018-13396",
    "datePublished": "2018-11-05T22:00:00Z",
    "dateReserved": "2018-07-06T00:00:00",
    "dateUpdated": "2024-09-16T21:03:34.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted