- announce - lists.freelock.com

[ledgersmb-announce] Security announcement for CVE-2018-9246 / PGObject::Util::DBAdmin
by Erik Huelsmann 06 Jun '18

06 Jun '18

This mail is sent to this mailing list because PGObject::Util::DBAdmin itself doesn't have a mailing list to send the disclosure to. We'll update its repository to reflect the announcement below. Please take note of the security advisory below, known as CVE-2018-9246 Nick Prater discovered that the PGObject::Util::DBAdmin insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection. The vulnerability allows an attacker to execute arbitrary code with the same privileges as the running application through the create(), run_file(), backup() and restore() functions. Affected versions: PGObject::Util::DBAdmin versions 0.110.0 and lower. Vulnerability type: Insufficiently sanitized arguments in external program invocation Discoverer: Nick Prater (NP Broadcast LTD) Resolution: Upgrade to PGObject::Util::DBAdmin 0.120.0 or newer. (0.130.0 available on CPAN). Kind regards, -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 1

[ledgersmb-announce] LedgerSMB 1.6.0-rc2 released
by Erik Huelsmann 06 Jun '18

06 Jun '18

Hi, After the LedgerSMB 1.6.0-rc1 release of two weeks ago, work has continued and we've found and solved several issues. We're now releasing 1.6.0-rc2 with the fixes listed below for your testing. Please send feedback to devel(a)lists.ledgersmb.org or file your issues through GitHub ( https://github.com/ledgersmb/LedgerSMB/issues). Fixes in LedgerSMB 1.6.0-rc2 (over 1.6.0-rc1): - Add more scripts to help resolve schema migration problems - Fix mailing of invoices, orders, etc. - Fix UTF-8 encoding issue with schema migration check output - Fix CSV import code not processing uploaded input correctly - Correctly detect UTF-8 (due to BOM) on uploaded form content (files) - Fix e-mail attachments - Fix and clean up LedgerSMB::File module and children (with tests) Please note that we're releasing 1.6.0-rc2; this means we think this code is production ready and that the database schema is stable. You're highly encouraged to try this version, however, if you run it in production (even though some of the developers are), you should consider yourself an early adopter. We'd highly appreciate your testing and feedback. For an overview of the changes in version 1.6, please check our release notes: https://ledgersmb.org/content/16-release-notes; for an in-depth listing of the changes since 1.5, see our Changelog: https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L2-L60 As always, the release can be downloaded from the download site: https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-rc2/ Or Docker images can be pulled through: $ docker pull ledgersmb/ledgersmb:1.6 With our Docker Compose file ( https://github.com/ledgersmb/ledgersmb-docker/blob/1.6/docker-compose.yml), you can set up a full evaluation environment with a single command: $ docker-compose up -d from the directory where the docker-compose.yml file is stored. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 2

[ledgersmb-announce] Release of ledgersmb-1.5 v1.5.21-1
by Robert J. Clay 02 Jun '18

02 Jun '18

An initial version of the debian ledgersmb-1.5 package for version 1.5.21-1 has been released and uploaded to our apt package repository for 'main' in stretch[1]. It has also been uploaded to our PPA[2], for 'artful' (v17.10) as well as 'xenial (v16.04 LTS) and 'bionic (v18.04 LTS). (The Debian source packages are available as well.) (Note also that this is likely the last time that a build for 'artful' will be done as it hits End of Life next month.) The packages at both our apt package repository and our PPA: ledgersmb-1.5 ledgersmb-1.5-apache ledgersmb-1.5-lighttpd ledgersmb-1.5-nginx ledgersmb-1.5-varnish Only the main 'ledgersmb-1.5' package is required; the others are related to which web proxy you might want to use and you only need one of them. -- Robert James Clay rjclay(a)gmail.com, jame(a)rocasa.us GPG ID: 2448 3AE0 874D 8696 6DCD ECF4 198C AB6F 43B7 EA9A. [1] https://apt.ledgersmb.org/ [2] https://launchpad.net/~ledgersmb/+archive/ubuntu/main/+packages -- Robert J. Clay rjclay(a)gmail.com

1 0

[ledgersmb-announce] LedgerSMB 1.5.21 released
by Erik Huelsmann 31 May '18

31 May '18

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.5.21 * Clarify message after changing password through Preferences (Nick P) * Fix errors in ODS report tepmlate's title page (Nick P) * Fix #3642: Taxform report generation failing (Erik H) * Detect BOM to determine UTF-8 CSV imports (Erik H) Nick P is Nick Prater Erik H is Erik Huelsmann For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.5.21/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.5.21 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.5.21 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.5.21 These are the sha256 checksums of the uploaded files: 0262e77b9651521eca30bc69621dcdb68e7d13667facdaf845ad9bab23efc79e ledgersmb-1.5.21.tar.gz 1d1d2c858b46c22f0c29f201b42732a9d3b60c81f7bd0340c22031674b228683 ledgersmb-1.5.21.tar.gz.asc

1 0

[ledgersmb-announce] [ANNOUNCE] LedgerSMB 1.6.0-rc1 released
by Erik Huelsmann 22 May '18

22 May '18

Hi, After the LedgerSMB 1.6.0-beta2 release of last week, work has continued and we've found and solved several issues. We're now releasing 1.6.0-rc1 with the fixes listed below for your testing. Please send feedback to devel(a)lists.ledgersmb.org or file your issues through GitHub ( https://github.com/ledgersmb/LedgerSMB/issues). Fixes in LedgerSMB 1.6.0-rc1 (over 1.6.0-beta2): - Fixed file (document attachment) uploads - Fix (invoice, etc) template uploads - Fix SQL Ledger migration script execution With special thanks to Nick Prater who found and fixed all of them. Please note that we're releasing 1.6.0-rc1; this means we think this code is production ready and that the database schema is stable. You're highly encouraged to try this version, however, if you run it in production (even though some of the developers are), you should consider yourself an early adopter. We'd highly appreciate your testing and feedback. For an overview of the changes in version 1.6, please check our release notes: https://ledgersmb.org/content/16-release-notes; for an in-depth listing of the changes since 1.5, see our Changelog: https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L2-L60 As always, the release can be downloaded from the download site: https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-rc1/ Or Docker images can be pulled through: $ docker pull ledgersmb/ledgersmb:1.6 With our Docker Compose file ( https://github.com/ledgersmb/ledgersmb-docker/blob/1.6/docker-compose.yml), you can set up a full evaluation environment with a single command: $ docker-compose up -d from the directory where the docker-compose.yml file is stored. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

[ledgersmb-announce] [ANNOUNCE] LedgerSMB 1.6.0-beta2 released
by Erik Huelsmann 13 May '18

13 May '18

Hi, After the LedgerSMB 1.6.0-beta1 release of last week, work continued on the regular high pace and we've found and solved several issues. We're now releasing 1.6.0-beta2 with the fixes listed below for your further testing. Please send your feedback to devel(a)lists.ledgersmb.org or file your issues through GitHub (https://github.com/ledgersmb/LedgerSMB/issues). Fixes in LedgerSMB 1.6.0-beta2 (over 1.6.0-beta1): - Stricter checking for failure during schema setup and updates - Multiple fixes for schema updates from 1.4 and 1.5 - Database version check not happening (regression) fixed - Fix regression in rendering of aging reports, warehouse listing and recurring transactions listing - Add a validity constraint to the password-duration setting - Clarified error message in case of failure to set password through Preferences menu - Fix password reset button and Save groups buttons in setup.pl - Invert the meaning of the checkmark in the Payment/Receipt screen - Remove execute bit from *.po (translation) files - Remove SourceForge list address from translation files (replace with current ledgersmb.org address) - Fix title pages for ODS, XLS and XLSX templates - Fix no data showing up in PDF output for reports - Fix broken permalinks to search output - Restore Save popup when downloading report output The list of changes in 1.6 (over 1.5) is at https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L2-L60 The release tarball can be downloaded from https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-beta2/ Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6 -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

[ledgersmb-announce] 1.6.0-beta1 uploaded for general testing
by Erik Huelsmann 06 May '18

06 May '18

Hi, This is to let you know that I've just finished uploading LedgerSMB 1.6.0beta1 (taken from our repository at commit hash 9956baac) for early-bird testing and evaluation purposes to https://download.ledgersmb.org/f/Beta%20Releases/1.6.0-beta1/ . Note that the difference between the uploaded tar and the git commit is that the tar contains our minified Dojo Toolkit dependency. Among other things, we'll be using this upload to develop our Docker images before the final 1.6.0 release. You're encouraged to do the same with any dependencies and/or packaging procedures you may have and report your problems either to devel(a)lists.ledgersmb.org or in the GitHub issue tracker. Before filing a ticket, please check if a similar issue has already been filed. The changelog for the 1.6 release series can be found here: https://github.com/ledgersmb/LedgerSMB/blob/1.6/Changelog#L2-L59 -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 1

[ledgersmb-announce] [ANNOUNCE] 1.6 ready for translation
by Erik Huelsmann 05 May '18

05 May '18

Hi, This is an announcement for translators: on Friday we branched 1.6 and prepared it for translation. We expect to release 1.6.0 late this quarter or early next quarter. Although translations can be done any time, releasing 1.6.0 with complete translations makes for a much better impression on new users of course. To those who aren't translators yet: this is an opportunity to contribute to the project! It's easy to become a LedgerSMB translator by navigating to https://www.transifex.com/ledgersmb/ledgersmb/dashboard/ , click on the "Help translate LedgerSMB" button and follow the sign-up steps. If you have any questions regarding translation, please post to devel(a)lists.ledgersmb.org. Regards, Erik

1 0

[ledgersmb-announce] Release of ledgersmb-1.5 v1.5.20-1
by Robert J. Clay 15 Apr '18

15 Apr '18

An initial version of the debian package ledgersmb-1.5 for version 1.5.20-1 has been released and uploaded to our apt repository for 'main' in stretch[1]. It has also been uploaded to our PPA[2], for 'artful' (v17.10) as well as 'xenial (v16.04) and 'bionic (which will be v18.04). (The Debian source packages are available as well.) The packages at both our apt package repository and our PPA: ledgersmb-1.5 ledgersmb-1.5-apache ledgersmb-1.5-lighttpd ledgersmb-1.5-nginx ledgersmb-1.5-varnish Only the main 'ledgersmb-1.5' package is required; the others are related to which web proxy you might want to use and you only need one of them. -- Robert J. Clay rjclay(a)gmail.com, jame(a)rocasa.us GPG ID: 2448 3AE0 874D 8696 6DCD ECF4 198C AB6F 43B7 EA9A. [1] https://apt.ledgersmb.org/ [2] https://launchpad.net/~ledgersmb/+archive/ubuntu/main/+packages

1 0

[ledgersmb-announce] LedgerSMB 1.5.20 released
by Erik Huelsmann 14 Apr '18

14 Apr '18

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.5.20 * Fix inability to save custom sequences (System > Sequence) (Erik H, #3511) * Fix error when downloading balance sheet as PDF (Erik H, #3515) * Fix empty backup file due to PGObject::Util::DBAdmin 0.120 (Erik H, #3531) * Norwegian (nb) translation update (Havard S) Erik H is Erik Huelsmann Havard S is Havard Sorli For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.5.20/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.5.20 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.5.20 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.5.20 These are the sha256 checksums of the uploaded files: bb815d97b23707c6f70b1a5cac56adb86fd0c841a5c4b403770760fee1a8392c ledgersmb-1.5.20.tar.gz 8931bac54f7b877486629fdf296968ad1b93bed11067116db8cbe531cecc4625 ledgersmb-1.5.20.tar.gz.asc

1 0