- devel - lists.freelock.com

LedgerSMB 1.11.17 released
by Erik Huelsmann 06 Sep '24

06 Sep '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.17 * Fix negative COGS for assemblies [*only* assemblies affected] (#8351) for more info see https://ledgersmb.org/content/cogs-assembly-fix * Fix saved orders and quotes showing as read-only [Part 2] (#8348) Important! Only users of assemblies are affected by the COGS bug fixed in this release. This fix - due to its extent - will **not** be released for 1.10, as there's only one month of community support left until end-of-life. Those using assemblies are urged to upgrade to 1.11.17 to benefit from the fix. For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.17/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.17 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.17 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.17 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.17 These are the sha256 checksums of the uploaded files: f0da3f804e5d32c33dbc307c3a9fed9a0a25f16716d64a569e53cd4ed8af65d9 ledgersmb-1.11.17.tar.gz 289551a802ca18cd8cd0744de80e208f3b19617883872bfe549001067e47257a ledgersmb-1.11.17.tar.gz.asc

1 0

LedgerSMB 1.11.16 released
by Erik Huelsmann 21 Aug '24

21 Aug '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.16 * Restore 'Save Template' on GL transations, regressed from 1.10 (#8340) * Fix saved orders and quotes showing as read-only (#8348) * Fix AR/AP Outstanding Summary report generation (#8378) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.16/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.16 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.16 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.16 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.16 These are the sha256 checksums of the uploaded files: 5e583ee9ef3172fcf10d316d00be50cfa7cf10e2a22abcbb7cef57c1f3beeaa9 ledgersmb-1.11.16.tar.gz 667e9abe5570800e037808e5151d993a2c3d814674e4e951a2942edbba61e7f7 ledgersmb-1.11.16.tar.gz.asc

1 0

LedgerSMB 1.11.15 released
by Erik Huelsmann 01 Aug '24

01 Aug '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.15 * Fix order of comparisons with over 9 columns (#8246) * Remove spurious column from PNL and B/S CSV template (#8247) * Fix values in wrong columns in balance sheet CSV output (#8247) * Fix reconciliation between B/S and AR Aging report (#8300) * Show auto-generated invoice number after posting (#8322) * Prevent some actions on voided invoices and reversed transactions (#8324) * Fix migration failure when renamed role already exists (#8325) * Fix Save and Post buttons not appearing on Update of GL entry (#8327) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.15/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.15 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.15 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.15 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.15 These are the sha256 checksums of the uploaded files: ce886100dbc1a4a336e6e5e818202fdc5f3ca9d78c8e4d0485e25f1a88b6d912 ledgersmb-1.11.15.tar.gz 005ba063072eaa024794fdee5b53865a1cf66e6f70bb4280ead0030d9bb49fef ledgersmb-1.11.15.tar.gz.asc

1 0

LedgerSMB 1.10.37 released
by Erik Huelsmann 01 Aug '24

01 Aug '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.37 * Fix reconciliation between B/S and AR Aging report (#8300) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.37/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.37 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.37 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.37 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.37 These are the sha256 checksums of the uploaded files: 70431ad2e1732f8d278ab7b05373ee066424aa8a7a1b7c5e92facfa6682114a9 ledgersmb-1.10.37.tar.gz bcadbf25f21ff2648680c5002d72bf5fd067f3b73dc599c1055021f862c7487b ledgersmb-1.10.37.tar.gz.asc

1 0

Bug#1062845: ledgersmb: CVE-2024-23831
by Salvatore Bonaccorso 25 Jul '24

25 Jul '24

Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-2+deb11u3 Hi, The following vulnerability was published for ledgersmb. CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-q… [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c012… Regards, Salvatore

2 1

LedgerSMB 1.9.28 released
by Erik Huelsmann 09 Jul '24

09 Jul '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.28 * Fix deletion of parts groups (#7363) * Align invoice/order entry between databases with and without parts (#7374) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.28/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.28 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.28 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.9.28 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.28 These are the sha256 checksums of the uploaded files: 4b2c0c53de2d80f5fc5ec3f8ee3bea61e5624684ebb1c2d55b2c2472c904a5b4 ledgersmb-1.9.28.tar.gz ccad27a8f22c25bbea0c5fdef564df325e9c202bd95af5713c4f8c14038b0f49 ledgersmb-1.9.28.tar.gz.asc

1 0

LedgerSMB 1.9.29 released
by Erik Huelsmann 09 Jul '24

09 Jul '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.29 * Fix regression since 1.9.27 upgrading old companies while renaming setting * Fix selection of default AR/AP accounts while importing databases (#7419) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.29/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.29 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.29 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.9.29 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.29 These are the sha256 checksums of the uploaded files: feaf830ea206b8a0a20a0efab93a5c70ccf29f028bc28f7156b0484ec2f99609 ledgersmb-1.9.29.tar.gz b49c86e9a6d37f528c4a884357bd9c4954fbdd6b7c27b41ea34c34c348d67d66 ledgersmb-1.9.29.tar.gz.asc

1 0

ledgersmb 1.6.33+ds-2.2 MIGRATED to testing
by Debian testing watch 09 Jul '24

09 Jul '24

FYI: The status of the ledgersmb source package in Debian's testing distribution has changed. Previous version: 1.6.33+ds-2.1 Current version: 1.6.33+ds-2.2 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information.

1 0

ledgersmb_1.6.33+ds-2.2_source.changes ACCEPTED into unstable
by Debian FTP Masters 03 Jun '24

03 Jun '24

Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 25 May 2024 10:05:53 +0200 Source: ledgersmb Architecture: source Version: 1.6.33+ds-2.2 Distribution: unstable Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Chris Hofstaedtler <zeha(a)debian.org> Changes: ledgersmb (1.6.33+ds-2.2) unstable; urgency=medium . * Non-maintainer upload. * No source change upload to move systemd units into /usr. Checksums-Sha1: f7bb49513c1cb7c41b821e9ff317cb5bb1e4c79d 3275 ledgersmb_1.6.33+ds-2.2.dsc 381c7ee66c04c667206d65b7e0200283ce2daaee 39244 ledgersmb_1.6.33+ds-2.2.debian.tar.xz e77621cb41315d12f541b6ccfa2cbe25bac7d161 15551 ledgersmb_1.6.33+ds-2.2_arm64.buildinfo Checksums-Sha256: 00c86d16229fd8e900b7995cdb43a677c887994f66e5a442c62a8fd941a1d29d 3275 ledgersmb_1.6.33+ds-2.2.dsc 6397c88faa13f18652787d8fe17a7dc95aa621a72d148921b321aecae4a96030 39244 ledgersmb_1.6.33+ds-2.2.debian.tar.xz 639a1cb4426dc721a2c95458060695378a11966df50b9f5a29a08209384ead58 15551 ledgersmb_1.6.33+ds-2.2_arm64.buildinfo Files: 5743f8ba265a802f9cff144db8cef9ac 3275 web optional ledgersmb_1.6.33+ds-2.2.dsc e3b092e7f886ade1cf942a42a39312e4 39244 web optional ledgersmb_1.6.33+ds-2.2.debian.tar.xz 943cbc1d5d270525a58b5e99f1a54db6 15551 web optional ledgersmb_1.6.33+ds-2.2_arm64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEfRrP+tnggGycTNOSXBPW25MFLgMFAmZRnQoACgkQXBPW25MF LgPWlQ//YnBb6KQO84/Ouhv+Y8xS9/jtVvfqSevFLFcmJc68Dhzy64lZc6mTwN36 QdXFpvqHyub7n0Uy/a1JEjcK/DZkNt9ulf43YsyyIjxQHXhGtpf6zKR0l8I62wyQ /ze3lZLmY2b0c+MZReXp89zi+G4ZKn+Zu9rO24mXVTht/k9aX3uASF9zMmEuQr/c EiVwzeUV19Il2kCgP/qAHr9Smx7IK2XjlftOGrJw3LM4panLDINJp3jqEnW0EGbc 6vLB6c+NCfDZFAj/mftPbVsgCoSrjQxYQGtPxHh52yxICQqJH+1Mk4KWX+spu7P/ Jjtx3i9HcivLdjygm7zFim8S0SOVX+sh8fDdAsDbxdXXNcM9wCBE5qcR1ffRlNi4 AyrM7dR7UAab2T+AH2Wo6yFAZt6I/e3Fek+TAvj27+4vALHw5IHcbi20i0Saww/q zVHBN/JhwRw1Ibc+ollWRGGTIRKkE23jmU3FPl9G9tcmQkWyWidp04CQXmJBVMk8 oYg5UbSlf9Ux7ekcZSefsIOAj9o+lpIrAGc3VC4Yovb86osFyz2RoefPPyM+/7bv kOSjwPooJoiUUehk48dCKYxk/Qx+0yE8QTA6FF37NhKDFgiQz/xHF2HqDqfWhZ/H e00SrmIgilto/xX85bNuqQLtrahx2+rM2cKki7XUA1gQXz8dP8Q= =jilP -----END PGP SIGNATURE-----

1 0

Processing of ledgersmb_1.6.33+ds-2.2_source.changes
by Debian FTP Masters 25 May '24

25 May '24

ledgersmb_1.6.33+ds-2.2_source.changes uploaded successfully to localhost along with the files: ledgersmb_1.6.33+ds-2.2.dsc ledgersmb_1.6.33+ds-2.2.debian.tar.xz ledgersmb_1.6.33+ds-2.2_arm64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org)

1 0

LedgerSMB 1.11.14 released
by Erik Huelsmann 06 May '24

06 May '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.14 * Fix drill-down on trial balance to pass report selections (#8177) * Fix read access on 'templates' table for printed documents (#8180) * Fix error when clicking 'Attach' button on e-mail screen (#8193) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.14/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.14 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.14 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.14 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.14 These are the sha256 checksums of the uploaded files: 3d285c4c8d22b03c71ecc2bfe04d7dc5b5b9414acbcd67a3f2485c263381e202 ledgersmb-1.11.14.tar.gz c5de88f42b68001e35a5b89bf7d1c85ad5355e151e7db62cb40c606a137e0c7a ledgersmb-1.11.14.tar.gz.asc

1 0

LedgerSMB 1.10.36 released
by Erik Huelsmann 06 May '24

06 May '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.36 * Fix drill-down on trial balance to pass report selections (#8177) * Fix read access on 'templates' table for printed documents (#8180) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.36/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.36 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.36 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.36 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.36 These are the sha256 checksums of the uploaded files: e1fc0aabbc6b8436cab6a038e915f395c3c2cd5b421e0f04a8dc810b632320e9 ledgersmb-1.10.36.tar.gz f0bb8b0a328ef25f90325e9480f07a0c38cddc66aa378ee30162f57724acc58a ledgersmb-1.10.36.tar.gz.asc

1 0

LedgerSMB 1.11.13 released
by Erik Huelsmann 26 Apr '24

26 Apr '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.13 * Compatibility with Workflow 2.0 [to be released] (#8138) * Fix recurring items re-using state of the original item (#8157) * Fix download links at the bottom of the tax form report (#8164) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.13/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.13 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.13 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.13 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.13 These are the sha256 checksums of the uploaded files: 7d4461112d90db7dc63786c924d4991693e3380e03d30a657e53250a27637c55 ledgersmb-1.11.13.tar.gz 03ecdf3e43909c7d028b1fd1ade2aa05e1ce08b330aec025d91b98f0b65d8965 ledgersmb-1.11.13.tar.gz.asc

1 0

LedgerSMB 1.10.35 released
by Erik Huelsmann 26 Apr '24

26 Apr '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.35 * Fix download links at the bottom of the tax form report (#8164) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.35/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.35 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.35 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.35 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.35 These are the sha256 checksums of the uploaded files: 674c324902d826ce37e9750f3ff4deaffc56a895a19043304e62bdd46f6589f5 ledgersmb-1.10.35.tar.gz c4a88630dd68c1e6f52b6a23d802ccde3a9228c5dda1f638006d4489759abd75 ledgersmb-1.10.35.tar.gz.asc

1 0

LedgerSMB 1.11.12 released
by Erik Huelsmann 09 Apr '24

09 Apr '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.12 * Fix download of attachments to reconciliations (#8088) * Fix e-mailing of AR aging statements (#8111) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.12/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.12 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.12 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.12 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.12 These are the sha256 checksums of the uploaded files: 067eaa68e6f8ea924bef5867be81ae254b2bac24943529fe7cffeaa2e8050a6c ledgersmb-1.11.12.tar.gz c19b2b70fcdc3ebccb096c91c20c3644944143dd7367c4502b248ffd3ce8d1cf ledgersmb-1.11.12.tar.gz.asc

1 0

LedgerSMB 1.10.34 released
by Erik Huelsmann 09 Apr '24

09 Apr '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.34 * Fix e-mailing of AR aging statements (#8111) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.34/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.34 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.34 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.34 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.34 These are the sha256 checksums of the uploaded files: 355ea0dff65a6647e3e2137a1a1fa0018d6b81c1b6d923c6282d6f0d8417e094 ledgersmb-1.10.34.tar.gz c5e19aee6c7e341f8ca24fa5c40e391cb015af9dfecb809cbe669a09339748b1 ledgersmb-1.10.34.tar.gz.asc

1 0

LedgerSMB 1.11.11 released
by Erik Huelsmann 15 Mar '24

15 Mar '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.11 * Fix 'not set up for hierarchy reporting' on Entity Account screen (#8065) * Fix date format presentation misalignment with placeholder (#7983) * Fix order of comparison periods in PNL and B/S (#7800) * Fix handling of discounts in invoice API (#8030) * Restore Hebrew 'nplurals' setting back to 4 * Enable scroll bars on setup(upgrade) data fix screens (#8071) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.11/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.11 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.11 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.11 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.11 These are the sha256 checksums of the uploaded files: 90d27fcff2815476a5c1c2e890f9f71c902c44d7279d7f30eee80ce1bfc4c47b ledgersmb-1.11.11.tar.gz 92f4a019079c97e0b679e0147cb9bf07ba5e776535a8dff262a32811e76048db ledgersmb-1.11.11.tar.gz.asc

1 0

LedgerSMB 1.10.33 released
by Erik Huelsmann 15 Mar '24

15 Mar '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.33 * Enable scroll bars on setup(upgrade) data fix screens (#8071) * Fix 'not set up for hierarchy reporting' on Entity Account screen (#8056) * Fix order of period comparisons in PNL and B/S (#7800) * Fix recurring transactions after setup.pl CSRF mitigation (#8042) * Revert Hebrew 'nplurals' back to 4 For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.33/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.33 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.33 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.33 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.33 These are the sha256 checksums of the uploaded files: 20ab27d7f8e55c60cd956cb2366428f74e7c7a3cd2d7fd96b2eefe3f72fe11b2 ledgersmb-1.10.33.tar.gz c75769b050619102ad965233259ba0d525222736a35be55331e74297a32837ed ledgersmb-1.10.33.tar.gz.asc

1 0

LedgerSMB 1.11.10 released
by Erik Huelsmann 15 Feb '24

15 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.10 * Fix upgrades from older Pg versions with the 'cash_impact' view (#7987) * Fix missing locale parameter creating GL Search report (#7997) * Fix setup.pl CSRF regressions (#8007, #8000) * Fix date filters on Cash > Receipt/Payment (#8015) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.10/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.10 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.10 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.10 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.10 These are the sha256 checksums of the uploaded files: 5c08194e794a81c81cae4f747860a09457e14331dcd1e48dc8bab991a589ab4d ledgersmb-1.11.10.tar.gz 47578b10d626b81f0dbbdf9c2cc34d2ed839586959a5c33fd8062a05e93e24cf ledgersmb-1.11.10.tar.gz.asc

1 0

LedgerSMB 1.10.32 released
by Erik Huelsmann 15 Feb '24

15 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.32 * Fix upgrades from older Pg versions with the 'cash_impact' view (#7987) * Fix missing locale parameter creating GL Search report (#7997) * Fix setup.pl CSRF regressions (#8007, #8000) * Fix date filters on Cash > Receipt/Payment (#8015) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.32/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.32 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.32 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.32 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.32 These are the sha256 checksums of the uploaded files: 3695a892e6c9c4257106a03ac287fdf9af94d8d55b6036bf7acf1aa340a1cd18 ledgersmb-1.10.32.tar.gz 45cee80848ff757e885208940eb996bbaa91aa7ab6d05cd5e8cef6491d19a733 ledgersmb-1.10.32.tar.gz.asc

1 0

LedgerSMB 1.11.9 released
by Erik Huelsmann 02 Feb '24

02 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for CVE-2024-23831, a CSRF attack on setup.pl. Changelog for 1.11.9 * Add missing batch and entity sequences to the Defaults screen (#7965) * Stop warning during startup without configuration file (#7928) * CVE-2024-23831: CSRF attack on 'setup.pl' For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.9/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.9 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.9 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.9 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.9 These are the sha256 checksums of the uploaded files: 5c4ae06702dadd0de3f4e26727fe10ed2086cb932029714a0fdae49553025cab ledgersmb-1.11.9.tar.gz 182f21f0a2f720f2d17e812619b4109f929e3a1d5d88e4b2e459a053472c6237 ledgersmb-1.11.9.tar.gz.asc

1 0

LedgerSMB 1.10.31 released
by Erik Huelsmann 02 Feb '24

02 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for security vulnerability CVE-2024-23831 which allows an attacker to create a user by tricking a setup.pl admin into clicking on a specifically crafted link. See more about this CVE on https://ledgersmb.org/cve-2024-23831-setup-csrf. Changelog for 1.10.31 * Fix GL transaction entry regressed from 1.10.29 (#7984) Changelog for 1.10.30 * Add missing batch and entity sequences to the Defaults screen (#7965) * Stop warning during startup without configuration file (#7928) * CVE-2024-23831: CSRF attack on 'setup.pl' For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.31/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.31 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.31 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.31 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.31 These are the sha256 checksums of the uploaded files: 15920bbe05a6e37ee9f4d7fe408adb587a20ae0e8c052f20df1e2909b4c7bc51 ledgersmb-1.10.31.tar.gz e03aeecd9087bbc25673bd13ec78962509f3b265886bb0a44949bde311cb06bc ledgersmb-1.10.31.tar.gz.asc

1 0

[SECURITY] Security advisory for CVE-2024-23831 (CSRF attack on setup.pl)
by Erik Huelsmann 02 Feb '24

02 Feb '24

On January 18 2024, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Privilege escalation through CSRF attack on 'setup.pl' Summary: ======== When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used to create a new user account with full application (/login.pl) privileges, leading to privilege escalation. Known vulnerable: ================= All of: - 1.3.0 up to 1.3.47 (including) - 1.4.0 up to 1.4.42 (including) - 1.5.0 up to 1.5.30 (including) - 1.6.0 up to 1.6.33 (including) - 1.7.0 up to 1.7.32 (including) - 1.8.0 up to 1.8.31 (including) - 1.9.0 up to 1.9.30 (including) - 1.10.0 up to 1.10.29 (including) - 1.11.0 up to 1.11.8 (including) Known fixed: ============ - 1.10.30 - 1.11.9 Details: ======== CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim’s behalf [^1]. To successfully perform the attack, an attacker needs to know the name of the database for which they want to create a user. That is: in case LedgerSMB is used to maintain multiple company administrations, multiple attacks need to be performed to gain access to all of them. A single attack will gain access to a single company only, however, if companies share users, the attacker can use those to gain access to the other companies with the rights of the affected user accounts. In this specific attack, the victim must be an administrator of /setup.pl with an active session. It should be noted that the resulting user does *not* have full access to /setup.pl, but *does* have full access to /login.pl for a single company. This means that the resulting user can therefore *not* be used to create database backups, however the attack itself can be used by the attacker to perform any action supported by setup.pl. [^1]: https://owasp.org/www-community/attacks/csrf Severity: ========= CVSSv3.1 Base Score: 7.5 (HIGH) CVSSv3.1 Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSSv3.1 Base Score & Vector (with temporal score): 6.7 (MEDIUM) CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/… Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.10 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade their 1.10 and 1.11 versions, may apply the included patches or are advised to contact a vendor for custom support. As a workaround, installations may choose not to expose and use /setup.pl, instead using the command line application "ledgersmb-admin" to perform administrative tasks. Password resets can be performed with regular /login.pl functionality or through PostgreSQL's "psql" command line tool. References: =========== CVE-2024-23831 (LedgerSMB) https://ledgersmb.org/cve-2024-23831-setup-csrf https://twelvesec.com/2024/02/02/cve-2024-23831 Reported by: ============ Georgios Roumeliotis (TwelveSec [twelvesec.com] -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

Test from Jack
by FWS Neil 26 Jan '24

26 Jan '24

Test from Jack

1 0

LedgerSMB 1.11.8 released
by Erik Huelsmann 13 Jan '24

13 Jan '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.8 * Fix changing Taxform checkmark after posting AR/AP transactions (#7894) * Restore customer/vendor name on PNL drilldown after GL column change (#7895) * Fix formatting of amounts on AR/AP search results (#7896) * Fix import of CoA csv with non-empty 'links' field (#7912) * Explicitly set foreground color on dark backgrounds in blue theme (#7875) * Fix screens, e.g. contacts, impacted by rename of 'action' parameter (#7918) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.8/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.8 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.8 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.8 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.8 These are the sha256 checksums of the uploaded files: 3a89187095ea6909c55d546776c25dacdbf63b980c43832c17031ac6dfea9c37 ledgersmb-1.11.8.tar.gz d832600caebe88b5dc39d4220e10e25ad912c037d7305d486ffa2e37f0e3d9a6 ledgersmb-1.11.8.tar.gz.asc

1 0