- announce - lists.freelock.com

LedgerSMB 1.11.9 released
by Erik Huelsmann 02 Feb '24

02 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for CVE-2024-23831, a CSRF attack on setup.pl. Changelog for 1.11.9 * Add missing batch and entity sequences to the Defaults screen (#7965) * Stop warning during startup without configuration file (#7928) * CVE-2024-23831: CSRF attack on 'setup.pl' For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.9/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.9 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.9 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.9 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.9 These are the sha256 checksums of the uploaded files: 5c4ae06702dadd0de3f4e26727fe10ed2086cb932029714a0fdae49553025cab ledgersmb-1.11.9.tar.gz 182f21f0a2f720f2d17e812619b4109f929e3a1d5d88e4b2e459a053472c6237 ledgersmb-1.11.9.tar.gz.asc

1 0

LedgerSMB 1.10.31 released
by Erik Huelsmann 02 Feb '24

02 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for security vulnerability CVE-2024-23831 which allows an attacker to create a user by tricking a setup.pl admin into clicking on a specifically crafted link. See more about this CVE on https://ledgersmb.org/cve-2024-23831-setup-csrf. Changelog for 1.10.31 * Fix GL transaction entry regressed from 1.10.29 (#7984) Changelog for 1.10.30 * Add missing batch and entity sequences to the Defaults screen (#7965) * Stop warning during startup without configuration file (#7928) * CVE-2024-23831: CSRF attack on 'setup.pl' For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.31/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.31 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.31 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.31 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.31 These are the sha256 checksums of the uploaded files: 15920bbe05a6e37ee9f4d7fe408adb587a20ae0e8c052f20df1e2909b4c7bc51 ledgersmb-1.10.31.tar.gz e03aeecd9087bbc25673bd13ec78962509f3b265886bb0a44949bde311cb06bc ledgersmb-1.10.31.tar.gz.asc

1 0

[SECURITY] Security advisory for CVE-2024-23831 (CSRF attack on setup.pl)
by Erik Huelsmann 02 Feb '24

02 Feb '24

On January 18 2024, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Privilege escalation through CSRF attack on 'setup.pl' Summary: ======== When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used to create a new user account with full application (/login.pl) privileges, leading to privilege escalation. Known vulnerable: ================= All of: - 1.3.0 up to 1.3.47 (including) - 1.4.0 up to 1.4.42 (including) - 1.5.0 up to 1.5.30 (including) - 1.6.0 up to 1.6.33 (including) - 1.7.0 up to 1.7.32 (including) - 1.8.0 up to 1.8.31 (including) - 1.9.0 up to 1.9.30 (including) - 1.10.0 up to 1.10.29 (including) - 1.11.0 up to 1.11.8 (including) Known fixed: ============ - 1.10.30 - 1.11.9 Details: ======== CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim’s behalf [^1]. To successfully perform the attack, an attacker needs to know the name of the database for which they want to create a user. That is: in case LedgerSMB is used to maintain multiple company administrations, multiple attacks need to be performed to gain access to all of them. A single attack will gain access to a single company only, however, if companies share users, the attacker can use those to gain access to the other companies with the rights of the affected user accounts. In this specific attack, the victim must be an administrator of /setup.pl with an active session. It should be noted that the resulting user does *not* have full access to /setup.pl, but *does* have full access to /login.pl for a single company. This means that the resulting user can therefore *not* be used to create database backups, however the attack itself can be used by the attacker to perform any action supported by setup.pl. [^1]: https://owasp.org/www-community/attacks/csrf Severity: ========= CVSSv3.1 Base Score: 7.5 (HIGH) CVSSv3.1 Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSSv3.1 Base Score & Vector (with temporal score): 6.7 (MEDIUM) CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/… Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.10 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade their 1.10 and 1.11 versions, may apply the included patches or are advised to contact a vendor for custom support. As a workaround, installations may choose not to expose and use /setup.pl, instead using the command line application "ledgersmb-admin" to perform administrative tasks. Password resets can be performed with regular /login.pl functionality or through PostgreSQL's "psql" command line tool. References: =========== CVE-2024-23831 (LedgerSMB) https://ledgersmb.org/cve-2024-23831-setup-csrf https://twelvesec.com/2024/02/02/cve-2024-23831 Reported by: ============ Georgios Roumeliotis (TwelveSec [twelvesec.com]) -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.11.8 released
by Erik Huelsmann 13 Jan '24

13 Jan '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.8 * Fix changing Taxform checkmark after posting AR/AP transactions (#7894) * Restore customer/vendor name on PNL drilldown after GL column change (#7895) * Fix formatting of amounts on AR/AP search results (#7896) * Fix import of CoA csv with non-empty 'links' field (#7912) * Explicitly set foreground color on dark backgrounds in blue theme (#7875) * Fix screens, e.g. contacts, impacted by rename of 'action' parameter (#7918) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.8/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.8 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.8 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.8 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.8 These are the sha256 checksums of the uploaded files: 3a89187095ea6909c55d546776c25dacdbf63b980c43832c17031ac6dfea9c37 ledgersmb-1.11.8.tar.gz d832600caebe88b5dc39d4220e10e25ad912c037d7305d486ffa2e37f0e3d9a6 ledgersmb-1.11.8.tar.gz.asc

1 0

LedgerSMB 1.10.29 released
by Erik Huelsmann 13 Jan '24

13 Jan '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.29 * Fix formatting of amounts in AR/AP search results (#7896) * Explicitly set foreground color on dark backgrounds in blue theme (#7875) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.29/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.29 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.29 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.29 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.29 These are the sha256 checksums of the uploaded files: 16ea9b92f180fa6be32b9c64e33506322582bfb64352d5cde73675ae91a61ec9 ledgersmb-1.10.29.tar.gz b179b2468fafdeb3127a440e281c0515788973321f031f89105ce30cfebbbb23 ledgersmb-1.10.29.tar.gz.asc

1 0

LedgerSMB 1.11.7 released
by Erik Huelsmann 31 Dec '23

31 Dec '23

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.7 * Fix creating an invoice from an order (#7855) * Retain partsgroup selection on Update in parts screen (#7848) * Fix missing columns on trial balance 'Ending' report type (#7870) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.7/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.7 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.7 Docker images have been published for ARMv7 (32-bit, e.g. Raspberry Pi (RPi) 3 and 400), ARM64 (e.g. RPi 4) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.7 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.7 These are the sha256 checksums of the uploaded files: d8086fff0340440ff022f455af8ee9486590a6c0b3db2262c4752bd1cc0384c0 ledgersmb-1.11.7.tar.gz df75cb6e6eb80843bf7c933581e72f28db86343817de743be62b4651b4c6227e ledgersmb-1.11.7.tar.gz.asc

1 0

LedgerSMB 1.10.28 released
by Erik Huelsmann 31 Dec '23

31 Dec '23

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.28 * Retain partsgroup selection on Update in parts screen (#7848) * Fix missing columns on trial balance 'Ending' report type (#7870) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.28/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.28 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.28 Docker images have been published for ARMv7 (32-bit, e.g. Raspberry Pi (RPi) 3 and 400), ARM64 (e.g. RPi 4) and AMD64. These can be pulled from the GitHub Container Registry: $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.28 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.28 These are the sha256 checksums of the uploaded files: 27d784cfb109ade19011297771a3a1143c97e132acc36f60421f2bd2ece646d0 ledgersmb-1.10.28.tar.gz ccd33e5c7feb59544a4c24754a0c7c764e7eb42b20ef13536e90f9f33749020c ledgersmb-1.10.28.tar.gz.asc

1 0

[ANNOUNCE] Docker images for ARM architectures (including Raspberry Pi)
by Erik Huelsmann 22 Dec '23

22 Dec '23

LS, Today, new 1.11.6 images were pushed (1.11.6-2) with several improvements: - New supported architectures "arm/v7" and "arm64" have been built and published, meaning that our Docker images can now be run on Raspberry Pi (RPi) 3 and RPi 400 (both arm/v7 devices) as well as RPi4 and up (arm64 devices) - When setting the LSMB_MAIL_SMTPHOST environment variable to the special value "__CONTAINER_GATEWAY__", the container dynamically figures out the subnet gateway IP address and configures this as the SMTPHOST address. Before this change, the SMTPHOST address defaulted to 172.17.0.1 which is the gateway on the default Docker network, which doesn't work when using the image with docker-compose -- the recommended way of running LedgerSMB containers Please provide us feedback with respect to our Docker images either on the users@ mailing list or by filing an issue at https://github.com/ledgersmb/ledgersmb-docker/issues. Regards, -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.11.6 released
by Erik Huelsmann 15 Dec '23

15 Dec '23

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.6 * Fix 'Current earnings' not showing in the balance sheet report (#7785) * Fix saving headings of headings (#7802) * Fix saving unused accounts configured for reconciliation (#7805) * Fix 'delete' link shown in CoA screen on accounts used with parts (#7812) * Fix deletion of parts (#7811) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.6/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.6 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.6 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.6 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.6 These are the sha256 checksums of the uploaded files: 0380c3f6a241bf9e03dc451f4cd1ab24c80d0fabf5fe23a1b7df4de5adeae449 ledgersmb-1.11.6.tar.gz 09f6174152971a1b6df2ff7c11e214e32264b0a5e8a539d8ab909d3ede4e4fff ledgersmb-1.11.6.tar.gz.asc

1 0

LedgerSMB 1.10.27 released
by Erik Huelsmann 15 Dec '23

15 Dec '23

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.27 * Fix 'delete' link shown in CoA screen on accounts used with parts (#7812) * Fix deletion of parts (#7811) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.27/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.27 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.27 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.27 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.27 These are the sha256 checksums of the uploaded files: b027084db8ad5cc3e97278661950d5824f1b95805d4f19c91aefc907c2ea3d09 ledgersmb-1.10.27.tar.gz 0ff833e7c6d96936ff20b52851b3684b8e8921d2d85b15c632fa4b95f284308a ledgersmb-1.10.27.tar.gz.asc

1 0