- devel - lists.freelock.com

LedgerSMB 1.9.0-beta1 released
by Erik Huelsmann 12 Sep '21

12 Sep '21

Hi all, Yesterday, I've uploaded the first beta for LedgerSMB 1.9.0 (ledgersmb-1.9.0-beta1). This release is available for download from https://download.ledgersmb.org/f/Beta%20Releases/1.9.0-beta1/ Or as a docker image with the command $ docker pull ledgersmb/ledgersmb:1.9.0-beta1 This beta is a feature complete version of ledgersmb-1.9.0 made available for testing and evaluation. Please send any bug reports, questions or surprises to the developers mailing list at devel(a)lists.ledgersmb.org or create an issue in the GitHub Issue tracker at https://github.com/ledgersmb/LedgerSMB/issues The 1.9.0 release has an impressive list of changes, available in the Changelog file at https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog#L6-L90 ; if you have any questions regarding the items listed, please feel free to join the LedgerSMB chat channel at https://app.element.io/#/room/#ledgersmb:matrix.org or post your question to the developers mailing list. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 1

ledgersmb 1.6.9+ds-2.1 MIGRATED to testing
by Debian testing watch 07 Sep '21

07 Sep '21

FYI: The status of the ledgersmb source package in Debian's testing distribution has changed. Previous version: 1.6.9+ds-2 Current version: 1.6.9+ds-2.1 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information.

1 0

LedgerSMB 1.8.20 released
by Erik Huelsmann 03 Sep '21

03 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.20 * Fix for chart of accounts headings import from CSV (#5987) * Correctly set the payment account in invoices and transactions (#5801) * Fix regression in CVE-2021-3693 failing to show errors as popups (#5921) * Fix regression in CVE-2021-3693 with broken downloads of backups (#5931) In addition to the above, it should be noted that the Docker images have been built with a new build procedure which provides better mapping of Perl dependencies to Debian packages. Due to this change, dependencies will be updated automatically. Should there be any issues with the images despite this improvement, please report to the GitHub issue tracker for the Docker images at: https://github.com/ledgersmb/ledgersmb-docker/issues For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.20/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.20 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.20 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.20 These are the sha256 checksums of the uploaded files: fd9c6dd36e656df592a2a241d1d3c1296e9fc45eb94610beccf5e0eab7db6541 ledgersmb-1.8.20.tar.gz 870128cf20b30f3b17d6d57ccbebd1769190ad72994ad28cd69e869b807d717e ledgersmb-1.8.20.tar.gz.asc

1 0

LedgerSMB 1.7.35 released
by Erik Huelsmann 03 Sep '21

03 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.35 * Fix for chart of accounts headings import from CSV (#5987) * Correctly set the payment account in invoices and transactions (#5801) * Fix regression in CVE-2021-3693 failing to show errors as popups (#5921) * Fix regression in CVE-2021-3693 with broken downloads of backups (#5931) In addition to the above, it should be noted that the Docker images have been built with a new build procedure which provides better mapping of Perl dependencies to Debian packages. Due to this change, dependencies will be updated automatically. Should there be any issues with the images despite this improvement, please report to the GitHub issue tracker for the Docker images at: https://github.com/ledgersmb/ledgersmb-docker/issues For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.35/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.35 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.35 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.35 These are the sha256 checksums of the uploaded files: ea291741c44c228b8a07e0bd738ada754457af5d9bee861e54057a42a5cd4512 ledgersmb-1.7.35.tar.gz 78e49149a015ac311d75367d88f23083da9648619f976bc17d3acbf165d8e5ce ledgersmb-1.7.35.tar.gz.asc

1 0

ledgersmb_1.6.9+ds-1+deb10u3_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates
by Debian FTP Masters 02 Sep '21

02 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Aug 2021 15:13:23 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-1+deb10u3 Distribution: buster-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-1+deb10u3) buster-security; urgency=medium . * Fix a regression in the display of some search results Checksums-Sha1: ebccf2c871bd2197b1e0ac309e5dd40e5c6f0922 3265 ledgersmb_1.6.9+ds-1+deb10u3.dsc 0908e81665237c357eaa2008ab4d6ae71653425a 38220 ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz b2259c998ccaaa22d72cb814d7945fbeaefdd4d0 15094 ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo Checksums-Sha256: 66c241afb732c84a2acc7404b93c0861a2102962aa494bc5d9b6fa4da4506af3 3265 ledgersmb_1.6.9+ds-1+deb10u3.dsc 19c0288b007acf0c282ee02f6f65b4bb8a1d374e3292444016ee2d475d990933 38220 ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz c1329758a3ff731c4cba2b375fcc97fb404fc2f25c8514a970fc6cdf12b5bbb8 15094 ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo Files: 84543a9de0999ce58a91dfee4ca6d211 3265 web optional ledgersmb_1.6.9+ds-1+deb10u3.dsc e475daabfbc222d55401d4ddf0376a5b 38220 web optional ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz be158058bb1cac4f6b887f50fa7aa195 15094 web optional ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEs3C4ACgkQEMKTtsN8 Tjbi0Q/+PVUa3LutIzJ3XAu/Q6jbaiQiMQpGirwpmFS2ot9m7Ul9WHdXmZZWyZZn YVd/GzODn2DVynXfEZvMFvJkQN0zX5uiInK0Fs/y6FFe9mxkSDYUohs3GwhGbPcL vyhbGAYBMcUbU5W1oYU+TQJS8W3ptwss2MwijPml/ln9YXnEDdp605mX4C0G1z+e lNvNeUfmKjicsdXvUn+Pxf3EU/XgESmSuaDVUu2U+/w/rkxri2bMmclHzcy1Uyot fej0wKCAgO9Qxjw4ubukvsEJAKps3sEyJWKjroRKX+H8td6Aw4vgDqlsChXLtACr BCWpU0Kh7pUWLfeS0FHgTlCVsV1xNWznAEslxvx58hDZrg7EYDYPMap1zQMGRkCk CRq3ltsK6OLqIbowd3h6x/239iq4es/lEtw2HsS3SizWjF72Qzml+20PC2ZS1fuQ j+PmStsVLcgTEsjnPCeKBFiyDpeu8Tb2ZxQz16G7d0FXxA1Q2e/U5YhEQ7kQ/hQq GPZa2uuVj/gD4ge41e26Bqgnqeqt/q9VNoSK4QMp87YypQ7k2yR1lKTQMPEQu9y2 LCsTCrTEQHj7THor7nHbs7E2kiUXyS2Akz9HIb1i1xluNBFLzDy/1hPsljJR3q64 8lWkmuBwELu4lPkR4ab+j/QM7exmER0gIdqlm1KwFg2R1K7xpXM= =k6Jh -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-2+deb11u3_amd64.changes ACCEPTED into proposed-updates->stable-new, proposed-updates
by Debian FTP Masters 02 Sep '21

02 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Aug 2021 15:19:14 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u3 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u3) bullseye-security; urgency=medium . * Fix a regression in the display of some search results Checksums-Sha1: 8fd5dd9a18165c22620ac9db83f5987b17c2edf2 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc 508725785247f8dce475c381b97c2c1245ce8076 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz de527f1284cc5c0544c7be6ff97ec4a4d3135cec 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Checksums-Sha256: 583984855c0b04ee20e32013016deb671519a8e97e35eca091f1b9dbefa1d193 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc da1aa64aacfd8f6836ade3e28d1f0a67e478c80db82c98b7a2b1699639f19eaa 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz 72b46a983f0303ce007548539aed9c9dc76028d09f360d301ea4cab8c553fadd 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Files: 8c6c6dde19d574ddb2444566b9fb1e71 3265 web optional ledgersmb_1.6.9+ds-2+deb11u3.dsc ae68c5012a260dc2499fe4059649f73d 38332 web optional ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz a819f275b2f6b45dab9efeb946ca5cc4 15403 web optional ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEs3lQACgkQEMKTtsN8 TjaptQ/8C6B2lIStWLqp1pOdglwKGIkTLEY0tAbnVZ4k/DOPWy35t5l73e4f18+R oYyTHEv1R+p7KiWAky4tIZJgS5q1AaV8w+D0VMTa6mXAMyfMYybkvILu7m+BFs0u agc9AsV7FNq+wNQoOeViRRkoOYnSgHPPm9b3Qs1v8T1aIaxOZylpCOdCR9lwZycW IbYCT8bOBqt3iuObyklSBW2SPpLcDjiguFXkrkY5BC9QAK2Xce4g/h43jqH0yKws Tul1dZw03o8lC5EQMFyXd+tntB3kMcBZ5yj0jrFtknYSRxfY7fnUVzDSaR4lPw77 V5rhqBVeWaCw0lqbPV2jEwaWm2xzA78SIbOX7wdNsKcwDaoaDVL5BtsA0W0nXY+L 8SYVh8oJl8GcEQn9+5UduEbT3Ro82ErXMQgdeVXTTsiZOO1xsdVaEWYAgIrZqcR7 NQlRXNXEbPu3P523HJfg6uDEhUwUmnQV1PunES5E//0woc57Fb385XNL0bJtcLHL po2wFIlHMMgvr1ZmHc3NNQLNRnHWzhrQFRoM2Cs1OJbKYkDRqDRjjk4NzHRZhHnY VBOXzRsf3iJHAsIEzI6upSHLDGD7r/9L/6qxm2O+hnoN+tErG/DHdMba5RDZExuQ CJGGmbXKOrTiTO61g6U2zM8J+5juHNnnCrWFHfXLo8GfNwtAzN0= =zw21 -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

Bug#992817: ledgersmb: CVE-2021-3693 CVE-2021-3694 CVE-2021-3731
by Salvatore Bonaccorso 01 Sep '21

01 Sep '21

Source: ledgersmb Version: 1.6.9+ds-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-1 Control: fixed -1 1.6.9+ds-1+deb10u2 Control: fixed -1 1.6.9+ds-2+deb11u2 Hi, The following vulnerabilities were published for ledgersmb. CVE-2021-3693[0]: | LedgerSMB does not check the origin of HTML fragments merged into the | browser's DOM. By sending a specially crafted URL to an authenticated | user, this flaw can be abused for remote code execution and | information disclosure. CVE-2021-3694[1]: | LedgerSMB does not sufficiently HTML-encode error messages sent to the | browser. By sending a specially crafted URL to an authenticated user, | this flaw can be abused for remote code execution and information | disclosure. CVE-2021-3731[2]: | LedgerSMB does not sufficiently guard against being wrapped by other | sites, making it vulnerable to 'clickjacking'. This allows an attacker | to trick a targetted user to execute unintended actions. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-3693 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3693 [1] https://security-tracker.debian.org/tracker/CVE-2021-3694 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3694 [2] https://security-tracker.debian.org/tracker/CVE-2021-3731 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3731 Please adjust the affected versions in the BTS as needed. Regards, Salvatore

2 2

ledgersmb_1.6.9+ds-2.1_source.changes ACCEPTED into unstable
by Debian FTP Masters 01 Sep '21

01 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 01 Sep 2021 20:19:24 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2.1 Distribution: unstable Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Mattia Rizzolo <mattia(a)debian.org> Closes: 992817 Changes: ledgersmb (1.6.9+ds-2.1) unstable; urgency=medium . * Non-maintainer upload. * Upload the last security fixes also to unstable. Closes: #992817 . ledgersmb (1.6.9+ds-2+deb11u3) bullseye-security; urgency=medium . * Fix a regression in the display of some search results . ledgersmb (1.6.9+ds-2+deb11u2) bullseye-security; urgency=medium . * Fix CVE-2021-3731, thanks to Erik Huelsmann . ledgersmb (1.6.9+ds-2+deb11u1) bullseye-security; urgency=medium . * Fix CVE-2021-3693 and CVE-2021-3694, thanks to Erik Huelsmann Checksums-Sha1: c5db18d0af429290e9258e4af13ba6fabd97a507 3241 ledgersmb_1.6.9+ds-2.1.dsc afaad1d50b746bed816647acc2e1bdc83af853e9 38380 ledgersmb_1.6.9+ds-2.1.debian.tar.xz 11ff32e100ac28c47c1c13500d7cba52af5b8836 15237 ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Checksums-Sha256: 3af1270aee67be5af8298c51cfe4c2d475306e661d87ece2cd1c00d568186992 3241 ledgersmb_1.6.9+ds-2.1.dsc 91f28e5c0f6b6fca1c1555d7083ffbc8883b61b245c4db790e9c44fccf86aa67 38380 ledgersmb_1.6.9+ds-2.1.debian.tar.xz d6f9f0b64da3b8619cd1250eeda8b9ae557909c70cfd3534956080d292ccbc49 15237 ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Files: c4debdee8daeb6412314ab946e6e6722 3241 web optional ledgersmb_1.6.9+ds-2.1.dsc 90c9f6cab8c0e97ba8b536e5981c766c 38380 web optional ledgersmb_1.6.9+ds-2.1.debian.tar.xz 0aeaaf798b7b50314283466628240b51 15237 web optional ledgersmb_1.6.9+ds-2.1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAmEvxhsACgkQCBa54Yx2 K634og//XG6bAL2cOJwSBU5vuHxow106v1Fz3Gge5yVM5v+y+2hPdRhf/tfGhy8T yNZU9mifNzheOpo1/Y/STXLgTvO7Z5nmXVrWBa2qPO9EaJrH6cp/18XZldIv/kdP HnvPlxeBKPPkkx5Jf1qnm2BW95LZ9NIN8xKsscaeOAZRhLaYNwnrjfwxaoXTy6Cn pCAcUDk9u2/0MSVOIZoz8o7vv+5WwqHI41CRyCVxYAxuj6mE0KOIz+AT0KFpFDB8 VjBV6XmHYuV5d7ArxEVcz+bnl/ufifUmBDYGvkmN8MM0kpNX5McWaRrR49ZmNUaV 8G9+M8wOhZaxjVstHk31TDQV4DvrPE5q/9ZRB6U/lI5zub9k5C6ewncv8IV+7/jq uqxSusV7bhfKTTCCVkCV2aoFDEyb2yjQqddLuLaKc4JAohafq8CiNFXBJM7kG8bz bqGhHEj5rF6+BMVRJxfrvTOlTQvMZFJY+038Pckytr6nL7BWd0mc1agRai1PM2Hu NifvQ1ciYNLKKPYtQsph9Mu/QpJ6fGP4xBNxheyt8AAkw2mAQR7MKRrPbO7NW/mv S+D9foqDdskplZZb913Br7XpIzBJneCaYyLvAhR5+AXWTZ5AAj6/3q3BPjLo8wyu pF8hPNmciBC1IMuecs3rBa6xE8pmZV+7svKIMLvP051slLnp/YI= =uahl -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

Processing of ledgersmb_1.6.9+ds-2.1_source.changes
by Debian FTP Masters 01 Sep '21

01 Sep '21

ledgersmb_1.6.9+ds-2.1_source.changes uploaded successfully to localhost along with the files: ledgersmb_1.6.9+ds-2.1.dsc ledgersmb_1.6.9+ds-2.1.debian.tar.xz ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org)

1 0

ledgersmb is marked for autoremoval from testing
by Debian testing autoremoval watch 01 Sep '21

01 Sep '21

ledgersmb 1.6.9+ds-2 is marked for autoremoval from testing on 2021-09-21 It is affected by these RC bugs: 992817: ledgersmb: CVE-2021-3693 CVE-2021-3694 CVE-2021-3731 https://bugs.debian.org/992817 This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/ma… Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gath…

1 0