SourceTree Update to Address GitHub Security Issue?
Asked by Frank Martinez:

Given the GitHub security issue described on Slashdot today, is there an update to SourceTree? Does the issue matter to SourceTree? If not, why not?


Answers:
author: KieranA
body: Hi all,

I've just deployed Mac 2.0.4 which has updated embedded version of Git and Mercurial to address CVE-2014-9390.

The Windows version will follow shortly and in the meantime you can use a system Git/Mercurial version.

EDIT: Windows version 1.6.12 \[released\] addresses CVE-2014-9390.

Update: please read the blog post for instructions to update the embedded Git/Mercurial versions in SourceTree for Windows. <https://blog.sourcetreeapp.com/2014/12/18/atlassian-update-for-git-and-mercurial-vulnerability/>

Cheers

comments: author: Stephan Amann
body: You're just great! Enjoy the holiday season...


author: Frank Martinez
body: Thanks. BTW, I got this message when trying to update from within SourceTree itself:'git log' failed with code -1:'launch path not accessible'(complete with the new line before the last single quote)


author: KieranA
body: This looks like a Mac issue, presumably, based on the output. It means that Git can't be found, so it's trying to execute something that's not there. Check your preferences again to ensure you're using embedded Git or a system Git version which is accessible.


author: Robert Glover
body: Here are the instructions from Atlassian on how to update SourceTree to a safe version of Git: <https://blog.sourcetreeapp.com/2014/12/18/atlassian-update-for-git-and-mercurial-vulnerability/>[](https://blog.sourcetreeapp.com/2014/12/18/atlassian-update-for-git-and-mercurial-vulnerability/)


author: Stephan Amann
body: There is a [Blog entry](https://blog.sourcetreeapp.com/2014/12/18/atlassian-update-for-git-and-mercurial-vulnerability/), stating to switch from embedded GIT to System GIT... However, neither for Mac nor for Windows there is an uptodate command line package available (see <http://git-scm.com/download/mac> and <http://git-scm.com/download/mac>).

One workaround I found, is to install the GitHub client (<https://mac.github.com/>, <https://windows.github.com/>) and let SourceTree use the git commandline from GitHub. But this does not work (error message: fatal: Unable to find remote helper for 'http'), or compile GIT from the sources.

Atlassian should come up asap with an update for SourceTree!

comments: author: Seth
body: It may have changed in the last few hours, but git-scm.com/download/win has version 1.9.5, which is listed as one of the safe options.


author: KieranA
body: I've posted an answer on this thread, thanks for bringing this AAC Q to my attention.


author: Seth
body: Maybe @Kieran Senior \[Atlassian\] can give us an idea when/if there will be an update to SourceTree's embedded git.


author: Thomas Casteleyn
body: You could install latest git (2.2.1) with [homebrew](http://brew.sh) this way:

```
brew install git
```

And then simply point to /usr/local/bin/git as system git in SourceTree.


author: Robert Glover
body: My experience on MAC was that when I told SourceTree to use System Git, it offered to install "Apple Git". I took that option, "Apple Git" installed itself, and SourceTree since then has been pointing to that version of git, as shown below:

RdgJrMacBookPro:SourceTreeTest1 rdg$ cd /usr/bin

RdgJrMacBookPro:bin rdg$ ls -lsa git

8 -rwxr-xr-x 1 root wheel 14160 Sep 26 22:06 git

RdgJrMacBookPro:bin rdg$ git --version

git version 1.9.3 (Apple Git-50)

RdgJrMacBookPro:bin rdg$ pwd

/usr/bin

RdgJrMacBookPro:bin rdg$

<br />

In the case of Win7, I also run SourceTree on Win7 via bootcamp. Over there, I had already installed git before I installed SourceTree. I think it was "msysgit". Anywhere, it was a simple matter of pointing SourceTree to the location of "git" in that prior installation, to use instead of SourceTree's internal git.

comments: author: Seth
body: According to the blog post, you may still be vulnerable. The recommended 1.9.x release is 1.9.5, your Apple Git is 1.9.3.


author: Robert Glover
body: Yes, I agree. I need to upgrade from 1.9.3 to 1.9.5. Thanks for pointing this out. My guess is that Atlassian will issue an update for SourceTree quickly that makes their internal version safe as well.


Tags: github