Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

The embedded version of [Git LFS|https://git-lfs.github.com] used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing them to execute arbitrary code on systems running a vulnerable version of Sourcetree for macOS. This vulnerability can also be triggered from a web page through the use of the Sourcetree URI handler.

Affected versions:

• Versions of Sourcetree for macOS starting with 2.1 before version 2.7.0 are affected by this vulnerability

Fix:

• Upgrade Sourcetree for macOS to version 2.7.0 or higher from https://www.sourcetreeapp.com/ .

For additional details see the [full advisory|https://confluence.atlassian.com/x/lIIyO].