I believe SourceTree for windows is using LibGit2 v0.24.0 from March 2016 which has 5 subsequent versions that fix known security issues including 2 CVEs.
I'm basing this on "C:\Users\<users>\AppData\Local\SourceTree\app-188.8.131.52\NativeBinaries\amd64" containing the file "git2-785d8c4.dll". The file properties say the version is 0.24.0, and the "785d8c4" matches the hash on that version. See https://github.com/libgit2/libgit2/releases/tag/v0.24.0
I looked into this because 2 of my repos crash SourceTree 184.108.40.206 in this dll (having upgraded from 1.19.x to this based on the security advisory). I've tried building my own version of LibGit2 v0.24.6, but SourceTree fails to start with it.
I'm hoping that someone can tell me I'm wrong about this, as it seems like somewhat of an "out of the security frying pan, into the security fire" problem, with a bonus of it crashing and being unusable.
Hi we are in the process of upgrading and testing these dependencies.
There is an existing Beta release, without those upgrades, which addresses a series of crashes related to libgit2's handling of repositories with possible data corruption, it can be downloaded here: https://downloads.atlassian.com/software/sourcetree/windows/beta/SourceTreeSetup-2.1.0-beta-002.exe
It is a beta, as such it will install alongside the GA/Production release and will not share data with the production release.
Is there any update on this? It's now 2.5 months and several release later, and the same, vulnerable, LibGit2 dll is being used (in version 220.127.116.11, the current latest on your website). This also means that my repos continue to crash in sourcetree.
I look forward to hearing some good news soon!
Supported Platforms macOS Sourcetree has a lot to offer and, like many developer tools, finding and using it all can be a challenge, especially for a new user. Everyone might not love ...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
We're bringing product updates and pro tips on teamwork to ten cities around the world.Save your spot