June 2024 - devel - lists.freelock.com

Bug#1062845: ledgersmb: CVE-2024-23831
by Salvatore Bonaccorso 26 Jul '24

26 Jul '24

Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-2+deb11u3 Hi, The following vulnerability was published for ledgersmb. CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-q… [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c012… Regards, Salvatore

2 1

LedgerSMB 1.9.28 released
by Erik Huelsmann 10 Jul '24

10 Jul '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.28 * Fix deletion of parts groups (#7363) * Align invoice/order entry between databases with and without parts (#7374) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.28/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.28 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.28 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.9.28 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.28 These are the sha256 checksums of the uploaded files: 4b2c0c53de2d80f5fc5ec3f8ee3bea61e5624684ebb1c2d55b2c2472c904a5b4 ledgersmb-1.9.28.tar.gz ccad27a8f22c25bbea0c5fdef564df325e9c202bd95af5713c4f8c14038b0f49 ledgersmb-1.9.28.tar.gz.asc

1 0

LedgerSMB 1.9.29 released
by Erik Huelsmann 10 Jul '24

10 Jul '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.29 * Fix regression since 1.9.27 upgrading old companies while renaming setting * Fix selection of default AR/AP accounts while importing databases (#7419) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.29/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.29 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.29 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.9.29 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.29 These are the sha256 checksums of the uploaded files: feaf830ea206b8a0a20a0efab93a5c70ccf29f028bc28f7156b0484ec2f99609 ledgersmb-1.9.29.tar.gz b49c86e9a6d37f528c4a884357bd9c4954fbdd6b7c27b41ea34c34c348d67d66 ledgersmb-1.9.29.tar.gz.asc

1 0

ledgersmb 1.6.33+ds-2.2 MIGRATED to testing
by Debian testing watch 10 Jul '24

10 Jul '24

FYI: The status of the ledgersmb source package in Debian's testing distribution has changed. Previous version: 1.6.33+ds-2.1 Current version: 1.6.33+ds-2.2 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information.

1 0

ledgersmb_1.6.33+ds-2.2_source.changes ACCEPTED into unstable
by Debian FTP Masters 04 Jun '24

04 Jun '24

Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 25 May 2024 10:05:53 +0200 Source: ledgersmb Architecture: source Version: 1.6.33+ds-2.2 Distribution: unstable Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Chris Hofstaedtler <zeha(a)debian.org> Changes: ledgersmb (1.6.33+ds-2.2) unstable; urgency=medium . * Non-maintainer upload. * No source change upload to move systemd units into /usr. Checksums-Sha1: f7bb49513c1cb7c41b821e9ff317cb5bb1e4c79d 3275 ledgersmb_1.6.33+ds-2.2.dsc 381c7ee66c04c667206d65b7e0200283ce2daaee 39244 ledgersmb_1.6.33+ds-2.2.debian.tar.xz e77621cb41315d12f541b6ccfa2cbe25bac7d161 15551 ledgersmb_1.6.33+ds-2.2_arm64.buildinfo Checksums-Sha256: 00c86d16229fd8e900b7995cdb43a677c887994f66e5a442c62a8fd941a1d29d 3275 ledgersmb_1.6.33+ds-2.2.dsc 6397c88faa13f18652787d8fe17a7dc95aa621a72d148921b321aecae4a96030 39244 ledgersmb_1.6.33+ds-2.2.debian.tar.xz 639a1cb4426dc721a2c95458060695378a11966df50b9f5a29a08209384ead58 15551 ledgersmb_1.6.33+ds-2.2_arm64.buildinfo Files: 5743f8ba265a802f9cff144db8cef9ac 3275 web optional ledgersmb_1.6.33+ds-2.2.dsc e3b092e7f886ade1cf942a42a39312e4 39244 web optional ledgersmb_1.6.33+ds-2.2.debian.tar.xz 943cbc1d5d270525a58b5e99f1a54db6 15551 web optional ledgersmb_1.6.33+ds-2.2_arm64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEfRrP+tnggGycTNOSXBPW25MFLgMFAmZRnQoACgkQXBPW25MF LgPWlQ//YnBb6KQO84/Ouhv+Y8xS9/jtVvfqSevFLFcmJc68Dhzy64lZc6mTwN36 QdXFpvqHyub7n0Uy/a1JEjcK/DZkNt9ulf43YsyyIjxQHXhGtpf6zKR0l8I62wyQ /ze3lZLmY2b0c+MZReXp89zi+G4ZKn+Zu9rO24mXVTht/k9aX3uASF9zMmEuQr/c EiVwzeUV19Il2kCgP/qAHr9Smx7IK2XjlftOGrJw3LM4panLDINJp3jqEnW0EGbc 6vLB6c+NCfDZFAj/mftPbVsgCoSrjQxYQGtPxHh52yxICQqJH+1Mk4KWX+spu7P/ Jjtx3i9HcivLdjygm7zFim8S0SOVX+sh8fDdAsDbxdXXNcM9wCBE5qcR1ffRlNi4 AyrM7dR7UAab2T+AH2Wo6yFAZt6I/e3Fek+TAvj27+4vALHw5IHcbi20i0Saww/q zVHBN/JhwRw1Ibc+ollWRGGTIRKkE23jmU3FPl9G9tcmQkWyWidp04CQXmJBVMk8 oYg5UbSlf9Ux7ekcZSefsIOAj9o+lpIrAGc3VC4Yovb86osFyz2RoefPPyM+/7bv kOSjwPooJoiUUehk48dCKYxk/Qx+0yE8QTA6FF37NhKDFgiQz/xHF2HqDqfWhZ/H e00SrmIgilto/xX85bNuqQLtrahx2+rM2cKki7XUA1gQXz8dP8Q= =jilP -----END PGP SIGNATURE-----

1 0