October 2024 - devel - lists.freelock.com

Bug#1082804: ledgersmb: FTBFS (test failure) if building as root
by наб 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.2 Severity: serious Tags: ftbfs Justification: fails to build from source Dear Maintainer, During a ratt run for src:ossp-uuid I got 2024/09/26 17:23:23 Building package 71 of 123: ledgersmb 2024/09/26 17:26:55 building ledgersmb failed: exit status 2 Full log attached, but the interesting bit is make[1]: Leaving directory '/<<PKGBUILDDIR>>' dh_auto_test make -j24 test make[1]: Entering directory '/<<PKGBUILDDIR>>' make[1]: git: No such file or directory /bin/sh: 1: lsb_release: not found prove t/ # Failed test 'use LedgerSMB::PSGI;' # at t/01-load.t line 231. # Tried to use 'LedgerSMB::PSGI'. # Error: Running a Web Service as root is a security problem. # If you are starting LedgerSMB as a system service, # please make sure that you drop privileges as per README.md # and the example files in conf/. # The method of passing a --user argument to starman cannot # be used as starman drops privileges too late, starting us as root. at /<<PKGBUILDDIR>>/lib/LedgerSMB/PSGI.pm line 42. # Compilation failed in require at t/01-load.t line 231. # BEGIN failed--compilation aborted at t/01-load.t line 231. # Looks like you failed 1 test of 209. t/01-load.t ..................... Dubious, test returned 1 (wstat 256, 0x100) Failed 1/209 subtests (less 5 skipped subtests: 203 okay) Name "Config::IniFiles::ledgersmb.conf" used only once: possible typo at /usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm line 60. t/02-number-handling.t .......... ok Per my reading of the policy, each d/rules target may be run as root? Best, -- System Information: Debian Release: 12.4 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.1.0-12-amd64 (SMP w/24 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled

3 4

Bug#1062845: ledgersmb: CVE-2024-23831
by Salvatore Bonaccorso 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-2+deb11u3 Hi, The following vulnerability was published for ledgersmb. CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-q… [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c012… Regards, Salvatore

2 2

Bug#1029045: ledgersmb: login page Perl error in default config
by JB 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.9+ds-2+deb11u3 Severity: important X-Debbugs-Cc: j-dbug.666.114.1101(a)x.firehead.org Dear Maintainer, I installed LedgerSMB with defaults on Debian-11 with systemd. It starts fine with Starman, but when I go to http://localhost:5762/login.pl it shows only this message: ----- Error! Can't locate object method "new" via package "Template" at /usr/share/ledgersmb/bin/../lib/LedgerSMB/Template.pm line 599. dbversion: , company: 1.6.9 ----- Thus leaving the package in an unusable state. -- System Information: Debian Release: 11.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-20-amd64 (SMP w/2 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages ledgersmb depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.77 ii dpkg 1.20.12 ii libcarp-always-perl 0.16-1 ii libcgi-emulate-psgi-perl 0.23-1 ii libcgi-simple-perl 1.115-2 ii libclass-c3-xs-perl 0.15-1+b1 ii libconfig-inifiles-perl 3.000003-1 ii libdata-uuid-perl 1.226-1+b1 ii libdatetime-format-strptime-perl 1.7800-1 ii libdatetime-perl 2:1.54-1 ii libdbd-pg-perl 3.14.2-1+b1 ii libdbi-perl 1.643-3+b1 ii libhtml-escape-perl 1.10-1+b3 ii libhttp-exception-perl 0.04007-1 ii libio-stringy-perl 2.111-3 ii libjs-dojo-dijit 1.15.4+dfsg1-1+deb11u1 ii libjson-perl 4.03000-1 ii liblocale-codes-perl 3.66-1 ii liblocale-maketext-lexicon-perl 1.00-1.1 ii liblog-log4perl-perl 1.54-1 ii libmime-lite-perl 3.031-1 ii libmime-types-perl 2.18-1 ii libmoose-perl 2.2014-2 ii libmoosex-nonmoose-perl 0.26-1.1 ii libnamespace-autoclean-perl 0.29-1 ii libnumber-format-perl 1.75-1.1 ii libpgobject-perl 2.2.0-1 ii libpgobject-simple-perl 3.000002-1.1 ii libpgobject-simple-role-perl 2.000002-1.1 ii libpgobject-type-bigfloat-perl 2.001-1 ii libpgobject-type-bytestring-perl 1.2.3-1 ii libpgobject-type-datetime-perl 2.000002-1 ii libpgobject-util-dbadmin-perl 1.4.0-1 ii libpgobject-util-dbmethod-perl 1.00.003-1 ii libplack-builder-conditionals-perl 0.05-1.1 ii libplack-middleware-reverseproxy-perl 0.16-1 ii libplack-perl 1.0048-1 ii libplack-request-withencoding-perl 0.14-1 ii libtemplate-perl 2.27-1+b3 ii libtext-markdown-perl 1.000031-3 ii libtry-tiny-perl 0.30-1 ii libversion-compare-perl 0.14-1.1 ii libxml-simple-perl 2.25-1 ii perl 5.32.1-4+deb11u2 ii postgresql-client 13+225 ii postgresql-client-13 [postgresql-client] 13.9-0+deb11u1 ii postgresql-contrib 13+225 ii starman 0.4015-1 ii ucf 3.0043 Versions of packages ledgersmb recommends: pn libjson-xs-perl <none> pn liblatex-driver-perl <none> pn libmath-bigint-gmp-perl <none> pn libtemplate-plugin-latex-perl <none> pn libtex-encode-perl <none> ii lighttpd 1.4.59-1+deb11u2 pn texlive-latex-recommended <none> Versions of packages ledgersmb suggests: pn default-mta | mail-transport-agent <none> pn latex-cjk-all <none> pn libimage-size-perl <none> pn libopenoffice-oodoc-perl <none> pn libx12-parser-perl <none> pn lpr <none> ii postgresql 13+225 pn texlive-xetex <none> -- debconf information: * ledgersmb/lsmb_proxy: Lighttpd * ledgersmb/admin_login: lsmb_dbadmin

2 1

Bug#1028924: ledgersmb: Init script calls start-stop-daemon incorrectly, fails to start
by JB 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.9+ds-2+deb11u3 Severity: important X-Debbugs-Cc: j-dbug.666.114.1101(a)x.firehead.org Dear Maintainer, I installed LedgerSMB with defaults on Debian-11 with sysvinit (instead of systemd). When I try to start the daemon, it produces the following output: # /etc/init.d/ledgersmb start $Starting ledgersmb: start-stop-daemon: unrecognized option '--interval=5' Try 'start-stop-daemon --help' for more information. # I am not an expert on start-stop-daemon, but looking at the init script, it seems start-stop-daemon is invoked with /usr/bin/start_server as the intended program to run, which then has further arguments for that to start /usr/bin/starman. However the start-stop-daemon invocation lacks a "--start" argument prior to the /usr/bin/start_server, and the "--start" seems to be the norm among other uses of start-stop-daemon in the system's /etc/init.d/* files. So maybe the init script is for some completely different version of start-stop-daemon, or the arguments are really for a different program, or something. I'm not quite sure. -- System Information: Debian Release: 11.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'oldstable-updates'), (500, 'stable'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-20-amd64 (SMP w/2 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: sysvinit (via /sbin/init) LSM: AppArmor: enabled Versions of packages ledgersmb depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.77 ii dpkg 1.20.12 ii libcarp-always-perl 0.16-1 ii libcgi-emulate-psgi-perl 0.23-1 ii libcgi-simple-perl 1.115-2 ii libclass-c3-xs-perl 0.15-1+b1 ii libconfig-inifiles-perl 3.000003-1 ii libdata-uuid-perl 1.226-1+b1 ii libdatetime-format-strptime-perl 1.7800-1 ii libdatetime-perl 2:1.54-1 ii libdbd-pg-perl 3.14.2-1+b1 ii libdbi-perl 1.643-3+b1 ii libhtml-escape-perl 1.10-1+b3 ii libhttp-exception-perl 0.04007-1 ii libio-stringy-perl 2.111-3 ii libjs-dojo-dijit 1.15.4+dfsg1-1+deb11u1 ii libjson-perl 4.03000-1 ii liblocale-codes-perl 3.66-1 ii liblocale-maketext-lexicon-perl 1.00-1.1 ii liblog-log4perl-perl 1.54-1 ii libmime-lite-perl 3.031-1 ii libmime-types-perl 2.18-1 ii libmoose-perl 2.2014-2 ii libmoosex-nonmoose-perl 0.26-1.1 ii libnamespace-autoclean-perl 0.29-1 ii libnumber-format-perl 1.75-1.1 ii libpgobject-perl 2.2.0-1 ii libpgobject-simple-perl 3.000002-1.1 ii libpgobject-simple-role-perl 2.000002-1.1 ii libpgobject-type-bigfloat-perl 2.001-1 ii libpgobject-type-bytestring-perl 1.2.3-1 ii libpgobject-type-datetime-perl 2.000002-1 ii libpgobject-util-dbadmin-perl 1.4.0-1 ii libpgobject-util-dbmethod-perl 1.00.003-1 ii libplack-builder-conditionals-perl 0.05-1.1 ii libplack-middleware-reverseproxy-perl 0.16-1 ii libplack-perl 1.0048-1 ii libplack-request-withencoding-perl 0.14-1 ii libtemplate-perl 2.27-1+b3 ii libtext-markdown-perl 1.000031-3 ii libtry-tiny-perl 0.30-1 ii libversion-compare-perl 0.14-1.1 ii libxml-simple-perl 2.25-1 ii perl 5.32.1-4+deb11u2 ii postgresql-client-13 [postgresql-client] 13.9-0+deb11u1 ii postgresql-contrib 13+225 ii starman 0.4015-1 ii ucf 3.0043 Versions of packages ledgersmb recommends: ii apache2 2.4.54-1~deb11u1 pn libjson-xs-perl <none> pn liblatex-driver-perl <none> pn libmath-bigint-gmp-perl <none> pn libtemplate-plugin-latex-perl <none> pn libtex-encode-perl <none> pn texlive-latex-recommended <none> Versions of packages ledgersmb suggests: ii exim4-daemon-light [mail-transport-agent] 4.94.2-7 pn latex-cjk-all <none> pn libimage-size-perl <none> pn libopenoffice-oodoc-perl <none> pn libx12-parser-perl <none> pn lpr <none> ii postgresql 13+225 pn texlive-xetex <none> -- debconf information: * ledgersmb/lsmb_proxy: None * ledgersmb/admin_login: lsmb_dbadmin

2 1

Bug#1027472: ledgersmb: upstram says 1.6 is unsupported and insecure. Newer upstream version 1.10 available
by Tobias Frost 18 Jan '26

18 Jan '26

Source: ledgersmb Severity: normal Tags: security Please consider updating ledgersmb. Filing as RC critical due to secrutiy issues in the old version. Upstream says: "The current stable release line is 1.10. For more information about older versions, see the FAQ item about supported releases. Versions 1.6 and older should no longer be used due to known security issues that cannot be resolved in that code base." [1] Upstream had declared 1.6 end of life 2021-06-10 [2] [1] https://ledgersmb.org/content/download [2] https://ledgersmb.org/faq/which-versions-do-you-support -- tobi

3 2

Adding to OpenBSD. Is this a good time now?
by chris＠bennettconstruction.us 19 Nov '24

19 Nov '24

A lot of Perl modules need to be imported into OpenBSD in order for it to be installable. I plan on asking for help to do this from OpenBSD users. It seems like LedgerSMB would now be a good import with all of the development of testing, etc. Are there any big changes on the immediate horizon for 1.5? I'm not running LedgerSMB because of the work that needs to be done first. As a side note, I am working on getting the forums back up, but $$ are a bit of a problem right now. Trying to find a baremetal server outside of the USA that I can afford hasn't been successful so far. I found one, but they charge $30 for remote access for 24 hours. I can't afford $90 a month, which is most of what I am finding. Thanks, Chris Bennett

3 2

Processed: severity of 1027472 is grave
by Debian Bug Tracking System 02 Nov '24

02 Nov '24

Processing commands for control(a)bugs.debian.org: > severity 1027472 grave Bug #1027472 [src:ledgersmb] ledgersmb: upstram says 1.6 is unsupported and insecure. Newer upstream version 1.10 available Severity set to 'grave' from 'normal' > thanks Stopping processing here. Please contact me if you need assistance. -- 1027472: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1027472 Debian Bug Tracking System Contact owner(a)bugs.debian.org with problems

2 1

[NOTICE] Upcoming 1.12 release -- looking for translators & testers
by Erik Huelsmann 28 Oct '24

28 Oct '24

Hi, In preparation for the 1.12 release, the project is looking for existing and new translators to update the software translations (see https://app.transifex.com/ledgersmb/ledgersmb/ledgersmb-112/) Any contribution is greatly appreciated, even if the translation is not complete: others can pick up where you left off. Also: translations are not just for 1.12: reusable translations will be used to translate 1.11 too. Soon a beta release will be published. In order to make the 1.12 release as stable as reasonably possible, the project needs beta testers: people who execute their most common workflows on (a copy!) of their data. We need these people to report the issues they run into, but also their successes! Regards, -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 1

LedgerSMB 1.11.18 released
by Erik Huelsmann 13 Oct '24

13 Oct '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.18 * Fix specifying an alternative database server port number (#8400) * Fix hostname with hyphen breaks ledgersmb-admin database URI (#8415) * Allow ledgersmb-admin to use pre-created databases, e.g. DigitalOcean (#8422) * Fix PNL and B/S CSV output missing 'heading_account' column (#8428) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.18/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.18 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.18 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.18 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.18 These are the sha256 checksums of the uploaded files: 4ac427cab5839a555bb438ff16c05610c951dd0e48ca216ce5f2ac5f4cb69dab ledgersmb-1.11.18.tar.gz 8bc0c43abf2790ecd98bcb6c550faacc7fc09ae73f61ae6d74981737a49d366d ledgersmb-1.11.18.tar.gz.asc

1 0

LedgerSMB 1.10.38 released End-of-Life 1.10 release branch
by Erik Huelsmann 13 Oct '24

13 Oct '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.38 * Fix PDF generation error for the outstanding AR/AP summary report (#8377) * Fix hostname with hyphen breaks ledgersmb-admin database URI (#8415) * Allow ledgersmb-admin to use pre-created databases, e.g. DigitalOcean (#8422) Please note that the 1.10 series is End-of-Life (EOL) as of October 8 2024, meaning that this is the last release in the series. For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.38/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.38 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.38 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.38 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.38 These are the sha256 checksums of the uploaded files: d8c679917a28ab8d052da6619f00cd20e7ede163ac59fbbfcaf5c35f52dfd843 ledgersmb-1.10.38.tar.gz fda36ee99cc99d6275e3b78b498f6e8b0547dfb40052741738bf3e74e75bd6ee ledgersmb-1.10.38.tar.gz.asc

1 0