Is SourceTree affeceted by CVE-2022-24826 "Git LFS vulnerability" ?

[Chihara]

Atlassian,

Is SourceTree affeceted by CVE-2022-24826 "Git LFS vulnerability" ?

[Chihara · Accepted solution]

I questioned about this to Atlassian and got as below;

It is resolved by latest Git 2.36.0 and Git LFS v3.1.4 and in Sourcetree we have also updated and will be released with SourceTree 3.4.9.

[Chihara · Accepted solution]

And Bamboo for WIndows too?

[Chihara]

There are some issues on JAC related "git lfs"  vulnerability ....

• https://jira.atlassian.com/browse/BAM-21284
• https://jira.atlassian.com/browse/BAM-21267
• https://jira.atlassian.com/browse/SRCTREEWIN-13480
• https://jira.atlassian.com/browse/SRCTREEWIN-13410
• https://jira.atlassian.com/browse/SRCTREEWIN-8261

[Vipin Yadav]

It is resolved by latest Git 2.36.0 and Git LFS v3.1.4 and in Sourcetree we have also updated and will be released with SourceTree 3.4.9. 

[Chihara]

Vipin,

Thank you.

Will Atlassian also release Bamboo for WIndows for CVE-2022-24826 like BAM-21284 and BAM-21267?

• https://jira.atlassian.com/browse/BAM-21284
• https://jira.atlassian.com/browse/BAM-21267

[Nic Brough -Adaptavist-]

Both applications use the git that is installed on the operating system that they are being run on.  You'll need to look at the version of git affected, not the applications.