- devel - lists.freelock.com

LedgerSMB 1.7.35 released
by Erik Huelsmann 03 Sep '21

03 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.35 * Fix for chart of accounts headings import from CSV (#5987) * Correctly set the payment account in invoices and transactions (#5801) * Fix regression in CVE-2021-3693 failing to show errors as popups (#5921) * Fix regression in CVE-2021-3693 with broken downloads of backups (#5931) In addition to the above, it should be noted that the Docker images have been built with a new build procedure which provides better mapping of Perl dependencies to Debian packages. Due to this change, dependencies will be updated automatically. Should there be any issues with the images despite this improvement, please report to the GitHub issue tracker for the Docker images at: https://github.com/ledgersmb/ledgersmb-docker/issues For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.35/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.35 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.35 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.35 These are the sha256 checksums of the uploaded files: ea291741c44c228b8a07e0bd738ada754457af5d9bee861e54057a42a5cd4512 ledgersmb-1.7.35.tar.gz 78e49149a015ac311d75367d88f23083da9648619f976bc17d3acbf165d8e5ce ledgersmb-1.7.35.tar.gz.asc

1 0

ledgersmb_1.6.9+ds-1+deb10u3_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates
by Debian FTP Masters 02 Sep '21

02 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Aug 2021 15:13:23 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-1+deb10u3 Distribution: buster-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-1+deb10u3) buster-security; urgency=medium . * Fix a regression in the display of some search results Checksums-Sha1: ebccf2c871bd2197b1e0ac309e5dd40e5c6f0922 3265 ledgersmb_1.6.9+ds-1+deb10u3.dsc 0908e81665237c357eaa2008ab4d6ae71653425a 38220 ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz b2259c998ccaaa22d72cb814d7945fbeaefdd4d0 15094 ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo Checksums-Sha256: 66c241afb732c84a2acc7404b93c0861a2102962aa494bc5d9b6fa4da4506af3 3265 ledgersmb_1.6.9+ds-1+deb10u3.dsc 19c0288b007acf0c282ee02f6f65b4bb8a1d374e3292444016ee2d475d990933 38220 ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz c1329758a3ff731c4cba2b375fcc97fb404fc2f25c8514a970fc6cdf12b5bbb8 15094 ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo Files: 84543a9de0999ce58a91dfee4ca6d211 3265 web optional ledgersmb_1.6.9+ds-1+deb10u3.dsc e475daabfbc222d55401d4ddf0376a5b 38220 web optional ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz be158058bb1cac4f6b887f50fa7aa195 15094 web optional ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEs3C4ACgkQEMKTtsN8 Tjbi0Q/+PVUa3LutIzJ3XAu/Q6jbaiQiMQpGirwpmFS2ot9m7Ul9WHdXmZZWyZZn YVd/GzODn2DVynXfEZvMFvJkQN0zX5uiInK0Fs/y6FFe9mxkSDYUohs3GwhGbPcL vyhbGAYBMcUbU5W1oYU+TQJS8W3ptwss2MwijPml/ln9YXnEDdp605mX4C0G1z+e lNvNeUfmKjicsdXvUn+Pxf3EU/XgESmSuaDVUu2U+/w/rkxri2bMmclHzcy1Uyot fej0wKCAgO9Qxjw4ubukvsEJAKps3sEyJWKjroRKX+H8td6Aw4vgDqlsChXLtACr BCWpU0Kh7pUWLfeS0FHgTlCVsV1xNWznAEslxvx58hDZrg7EYDYPMap1zQMGRkCk CRq3ltsK6OLqIbowd3h6x/239iq4es/lEtw2HsS3SizWjF72Qzml+20PC2ZS1fuQ j+PmStsVLcgTEsjnPCeKBFiyDpeu8Tb2ZxQz16G7d0FXxA1Q2e/U5YhEQ7kQ/hQq GPZa2uuVj/gD4ge41e26Bqgnqeqt/q9VNoSK4QMp87YypQ7k2yR1lKTQMPEQu9y2 LCsTCrTEQHj7THor7nHbs7E2kiUXyS2Akz9HIb1i1xluNBFLzDy/1hPsljJR3q64 8lWkmuBwELu4lPkR4ab+j/QM7exmER0gIdqlm1KwFg2R1K7xpXM= =k6Jh -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-2+deb11u3_amd64.changes ACCEPTED into proposed-updates->stable-new, proposed-updates
by Debian FTP Masters 02 Sep '21

02 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Aug 2021 15:19:14 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u3 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u3) bullseye-security; urgency=medium . * Fix a regression in the display of some search results Checksums-Sha1: 8fd5dd9a18165c22620ac9db83f5987b17c2edf2 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc 508725785247f8dce475c381b97c2c1245ce8076 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz de527f1284cc5c0544c7be6ff97ec4a4d3135cec 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Checksums-Sha256: 583984855c0b04ee20e32013016deb671519a8e97e35eca091f1b9dbefa1d193 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc da1aa64aacfd8f6836ade3e28d1f0a67e478c80db82c98b7a2b1699639f19eaa 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz 72b46a983f0303ce007548539aed9c9dc76028d09f360d301ea4cab8c553fadd 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Files: 8c6c6dde19d574ddb2444566b9fb1e71 3265 web optional ledgersmb_1.6.9+ds-2+deb11u3.dsc ae68c5012a260dc2499fe4059649f73d 38332 web optional ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz a819f275b2f6b45dab9efeb946ca5cc4 15403 web optional ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEs3lQACgkQEMKTtsN8 TjaptQ/8C6B2lIStWLqp1pOdglwKGIkTLEY0tAbnVZ4k/DOPWy35t5l73e4f18+R oYyTHEv1R+p7KiWAky4tIZJgS5q1AaV8w+D0VMTa6mXAMyfMYybkvILu7m+BFs0u agc9AsV7FNq+wNQoOeViRRkoOYnSgHPPm9b3Qs1v8T1aIaxOZylpCOdCR9lwZycW IbYCT8bOBqt3iuObyklSBW2SPpLcDjiguFXkrkY5BC9QAK2Xce4g/h43jqH0yKws Tul1dZw03o8lC5EQMFyXd+tntB3kMcBZ5yj0jrFtknYSRxfY7fnUVzDSaR4lPw77 V5rhqBVeWaCw0lqbPV2jEwaWm2xzA78SIbOX7wdNsKcwDaoaDVL5BtsA0W0nXY+L 8SYVh8oJl8GcEQn9+5UduEbT3Ro82ErXMQgdeVXTTsiZOO1xsdVaEWYAgIrZqcR7 NQlRXNXEbPu3P523HJfg6uDEhUwUmnQV1PunES5E//0woc57Fb385XNL0bJtcLHL po2wFIlHMMgvr1ZmHc3NNQLNRnHWzhrQFRoM2Cs1OJbKYkDRqDRjjk4NzHRZhHnY VBOXzRsf3iJHAsIEzI6upSHLDGD7r/9L/6qxm2O+hnoN+tErG/DHdMba5RDZExuQ CJGGmbXKOrTiTO61g6U2zM8J+5juHNnnCrWFHfXLo8GfNwtAzN0= =zw21 -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

Bug#992817: ledgersmb: CVE-2021-3693 CVE-2021-3694 CVE-2021-3731
by Salvatore Bonaccorso 01 Sep '21

01 Sep '21

Source: ledgersmb Version: 1.6.9+ds-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-1 Control: fixed -1 1.6.9+ds-1+deb10u2 Control: fixed -1 1.6.9+ds-2+deb11u2 Hi, The following vulnerabilities were published for ledgersmb. CVE-2021-3693[0]: | LedgerSMB does not check the origin of HTML fragments merged into the | browser's DOM. By sending a specially crafted URL to an authenticated | user, this flaw can be abused for remote code execution and | information disclosure. CVE-2021-3694[1]: | LedgerSMB does not sufficiently HTML-encode error messages sent to the | browser. By sending a specially crafted URL to an authenticated user, | this flaw can be abused for remote code execution and information | disclosure. CVE-2021-3731[2]: | LedgerSMB does not sufficiently guard against being wrapped by other | sites, making it vulnerable to 'clickjacking'. This allows an attacker | to trick a targetted user to execute unintended actions. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-3693 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3693 [1] https://security-tracker.debian.org/tracker/CVE-2021-3694 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3694 [2] https://security-tracker.debian.org/tracker/CVE-2021-3731 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3731 Please adjust the affected versions in the BTS as needed. Regards, Salvatore

2 2

ledgersmb_1.6.9+ds-2.1_source.changes ACCEPTED into unstable
by Debian FTP Masters 01 Sep '21

01 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 01 Sep 2021 20:19:24 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2.1 Distribution: unstable Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Mattia Rizzolo <mattia(a)debian.org> Closes: 992817 Changes: ledgersmb (1.6.9+ds-2.1) unstable; urgency=medium . * Non-maintainer upload. * Upload the last security fixes also to unstable. Closes: #992817 . ledgersmb (1.6.9+ds-2+deb11u3) bullseye-security; urgency=medium . * Fix a regression in the display of some search results . ledgersmb (1.6.9+ds-2+deb11u2) bullseye-security; urgency=medium . * Fix CVE-2021-3731, thanks to Erik Huelsmann . ledgersmb (1.6.9+ds-2+deb11u1) bullseye-security; urgency=medium . * Fix CVE-2021-3693 and CVE-2021-3694, thanks to Erik Huelsmann Checksums-Sha1: c5db18d0af429290e9258e4af13ba6fabd97a507 3241 ledgersmb_1.6.9+ds-2.1.dsc afaad1d50b746bed816647acc2e1bdc83af853e9 38380 ledgersmb_1.6.9+ds-2.1.debian.tar.xz 11ff32e100ac28c47c1c13500d7cba52af5b8836 15237 ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Checksums-Sha256: 3af1270aee67be5af8298c51cfe4c2d475306e661d87ece2cd1c00d568186992 3241 ledgersmb_1.6.9+ds-2.1.dsc 91f28e5c0f6b6fca1c1555d7083ffbc8883b61b245c4db790e9c44fccf86aa67 38380 ledgersmb_1.6.9+ds-2.1.debian.tar.xz d6f9f0b64da3b8619cd1250eeda8b9ae557909c70cfd3534956080d292ccbc49 15237 ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Files: c4debdee8daeb6412314ab946e6e6722 3241 web optional ledgersmb_1.6.9+ds-2.1.dsc 90c9f6cab8c0e97ba8b536e5981c766c 38380 web optional ledgersmb_1.6.9+ds-2.1.debian.tar.xz 0aeaaf798b7b50314283466628240b51 15237 web optional ledgersmb_1.6.9+ds-2.1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAmEvxhsACgkQCBa54Yx2 K634og//XG6bAL2cOJwSBU5vuHxow106v1Fz3Gge5yVM5v+y+2hPdRhf/tfGhy8T yNZU9mifNzheOpo1/Y/STXLgTvO7Z5nmXVrWBa2qPO9EaJrH6cp/18XZldIv/kdP HnvPlxeBKPPkkx5Jf1qnm2BW95LZ9NIN8xKsscaeOAZRhLaYNwnrjfwxaoXTy6Cn pCAcUDk9u2/0MSVOIZoz8o7vv+5WwqHI41CRyCVxYAxuj6mE0KOIz+AT0KFpFDB8 VjBV6XmHYuV5d7ArxEVcz+bnl/ufifUmBDYGvkmN8MM0kpNX5McWaRrR49ZmNUaV 8G9+M8wOhZaxjVstHk31TDQV4DvrPE5q/9ZRB6U/lI5zub9k5C6ewncv8IV+7/jq uqxSusV7bhfKTTCCVkCV2aoFDEyb2yjQqddLuLaKc4JAohafq8CiNFXBJM7kG8bz bqGhHEj5rF6+BMVRJxfrvTOlTQvMZFJY+038Pckytr6nL7BWd0mc1agRai1PM2Hu NifvQ1ciYNLKKPYtQsph9Mu/QpJ6fGP4xBNxheyt8AAkw2mAQR7MKRrPbO7NW/mv S+D9foqDdskplZZb913Br7XpIzBJneCaYyLvAhR5+AXWTZ5AAj6/3q3BPjLo8wyu pF8hPNmciBC1IMuecs3rBa6xE8pmZV+7svKIMLvP051slLnp/YI= =uahl -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

Processing of ledgersmb_1.6.9+ds-2.1_source.changes
by Debian FTP Masters 01 Sep '21

01 Sep '21

ledgersmb_1.6.9+ds-2.1_source.changes uploaded successfully to localhost along with the files: ledgersmb_1.6.9+ds-2.1.dsc ledgersmb_1.6.9+ds-2.1.debian.tar.xz ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org)

1 0

ledgersmb is marked for autoremoval from testing
by Debian testing autoremoval watch 31 Aug '21

31 Aug '21

ledgersmb 1.6.9+ds-2 is marked for autoremoval from testing on 2021-09-21 It is affected by these RC bugs: 992817: ledgersmb: CVE-2021-3693 CVE-2021-3694 CVE-2021-3731 https://bugs.debian.org/992817 This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/ma… Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gath…

1 0

ledgersmb_1.6.9+ds-2+deb11u3_amd64.changes ACCEPTED into proposed-updates->stable-new
by Debian FTP Masters 31 Aug '21

31 Aug '21

Mapping stable-security to proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Aug 2021 15:19:14 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u3 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u3) bullseye-security; urgency=medium . * Fix a regression in the display of some search results Checksums-Sha1: 8fd5dd9a18165c22620ac9db83f5987b17c2edf2 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc 508725785247f8dce475c381b97c2c1245ce8076 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz de527f1284cc5c0544c7be6ff97ec4a4d3135cec 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Checksums-Sha256: 583984855c0b04ee20e32013016deb671519a8e97e35eca091f1b9dbefa1d193 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc da1aa64aacfd8f6836ade3e28d1f0a67e478c80db82c98b7a2b1699639f19eaa 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz 72b46a983f0303ce007548539aed9c9dc76028d09f360d301ea4cab8c553fadd 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Files: 8c6c6dde19d574ddb2444566b9fb1e71 3265 web optional ledgersmb_1.6.9+ds-2+deb11u3.dsc ae68c5012a260dc2499fe4059649f73d 38332 web optional ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz a819f275b2f6b45dab9efeb946ca5cc4 15403 web optional ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEs3lQACgkQEMKTtsN8 TjaptQ/8C6B2lIStWLqp1pOdglwKGIkTLEY0tAbnVZ4k/DOPWy35t5l73e4f18+R oYyTHEv1R+p7KiWAky4tIZJgS5q1AaV8w+D0VMTa6mXAMyfMYybkvILu7m+BFs0u agc9AsV7FNq+wNQoOeViRRkoOYnSgHPPm9b3Qs1v8T1aIaxOZylpCOdCR9lwZycW IbYCT8bOBqt3iuObyklSBW2SPpLcDjiguFXkrkY5BC9QAK2Xce4g/h43jqH0yKws Tul1dZw03o8lC5EQMFyXd+tntB3kMcBZ5yj0jrFtknYSRxfY7fnUVzDSaR4lPw77 V5rhqBVeWaCw0lqbPV2jEwaWm2xzA78SIbOX7wdNsKcwDaoaDVL5BtsA0W0nXY+L 8SYVh8oJl8GcEQn9+5UduEbT3Ro82ErXMQgdeVXTTsiZOO1xsdVaEWYAgIrZqcR7 NQlRXNXEbPu3P523HJfg6uDEhUwUmnQV1PunES5E//0woc57Fb385XNL0bJtcLHL po2wFIlHMMgvr1ZmHc3NNQLNRnHWzhrQFRoM2Cs1OJbKYkDRqDRjjk4NzHRZhHnY VBOXzRsf3iJHAsIEzI6upSHLDGD7r/9L/6qxm2O+hnoN+tErG/DHdMba5RDZExuQ CJGGmbXKOrTiTO61g6U2zM8J+5juHNnnCrWFHfXLo8GfNwtAzN0= =zw21 -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-1+deb10u3_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new
by Debian FTP Masters 31 Aug '21

31 Aug '21

Mapping oldstable-security to oldstable-proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Aug 2021 15:13:23 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-1+deb10u3 Distribution: buster-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-1+deb10u3) buster-security; urgency=medium . * Fix a regression in the display of some search results Checksums-Sha1: ebccf2c871bd2197b1e0ac309e5dd40e5c6f0922 3265 ledgersmb_1.6.9+ds-1+deb10u3.dsc 0908e81665237c357eaa2008ab4d6ae71653425a 38220 ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz b2259c998ccaaa22d72cb814d7945fbeaefdd4d0 15094 ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo Checksums-Sha256: 66c241afb732c84a2acc7404b93c0861a2102962aa494bc5d9b6fa4da4506af3 3265 ledgersmb_1.6.9+ds-1+deb10u3.dsc 19c0288b007acf0c282ee02f6f65b4bb8a1d374e3292444016ee2d475d990933 38220 ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz c1329758a3ff731c4cba2b375fcc97fb404fc2f25c8514a970fc6cdf12b5bbb8 15094 ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo Files: 84543a9de0999ce58a91dfee4ca6d211 3265 web optional ledgersmb_1.6.9+ds-1+deb10u3.dsc e475daabfbc222d55401d4ddf0376a5b 38220 web optional ledgersmb_1.6.9+ds-1+deb10u3.debian.tar.xz be158058bb1cac4f6b887f50fa7aa195 15094 web optional ledgersmb_1.6.9+ds-1+deb10u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEs3C4ACgkQEMKTtsN8 Tjbi0Q/+PVUa3LutIzJ3XAu/Q6jbaiQiMQpGirwpmFS2ot9m7Ul9WHdXmZZWyZZn YVd/GzODn2DVynXfEZvMFvJkQN0zX5uiInK0Fs/y6FFe9mxkSDYUohs3GwhGbPcL vyhbGAYBMcUbU5W1oYU+TQJS8W3ptwss2MwijPml/ln9YXnEDdp605mX4C0G1z+e lNvNeUfmKjicsdXvUn+Pxf3EU/XgESmSuaDVUu2U+/w/rkxri2bMmclHzcy1Uyot fej0wKCAgO9Qxjw4ubukvsEJAKps3sEyJWKjroRKX+H8td6Aw4vgDqlsChXLtACr BCWpU0Kh7pUWLfeS0FHgTlCVsV1xNWznAEslxvx58hDZrg7EYDYPMap1zQMGRkCk CRq3ltsK6OLqIbowd3h6x/239iq4es/lEtw2HsS3SizWjF72Qzml+20PC2ZS1fuQ j+PmStsVLcgTEsjnPCeKBFiyDpeu8Tb2ZxQz16G7d0FXxA1Q2e/U5YhEQ7kQ/hQq GPZa2uuVj/gD4ge41e26Bqgnqeqt/q9VNoSK4QMp87YypQ7k2yR1lKTQMPEQu9y2 LCsTCrTEQHj7THor7nHbs7E2kiUXyS2Akz9HIb1i1xluNBFLzDy/1hPsljJR3q64 8lWkmuBwELu4lPkR4ab+j/QM7exmER0gIdqlm1KwFg2R1K7xpXM= =k6Jh -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-1+deb10u2_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates
by Debian FTP Masters 27 Aug '21

27 Aug '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 22 Aug 2021 20:54:25 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-1+deb10u2 Distribution: buster-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-1+deb10u2) buster-security; urgency=medium . * Fix CVE-2021-3731, thanks for Erik Huelsmann Checksums-Sha1: 81dff0043e075588fffb234efda4b78b641f5449 3265 ledgersmb_1.6.9+ds-1+deb10u2.dsc 851b39c25748d2a780895f8c2a450b94e53ac31e 37796 ledgersmb_1.6.9+ds-1+deb10u2.debian.tar.xz a3db94b57cf7fcdedaf9197ed8be469f2e673934 15094 ledgersmb_1.6.9+ds-1+deb10u2_amd64.buildinfo Checksums-Sha256: bc167a97c2e63a4c72882bb7d82a39cf79b56f51c3dabd330713922a5b4c7c2d 3265 ledgersmb_1.6.9+ds-1+deb10u2.dsc aef28aa91470f89a51ad87f14e8f6da13c9a79340fd96124a0e5f5c77ab80120 37796 ledgersmb_1.6.9+ds-1+deb10u2.debian.tar.xz bff4d79e7d88353b98a696bd2b6f16b3064c3e3716c4b401a4e19375c383dd5c 15094 ledgersmb_1.6.9+ds-1+deb10u2_amd64.buildinfo Files: 0fd6e172a26caf3ba19491665415ad32 3265 web optional ledgersmb_1.6.9+ds-1+deb10u2.dsc 630ed153ca2cbdddaffee480eead3ea7 37796 web optional ledgersmb_1.6.9+ds-1+deb10u2.debian.tar.xz 8349333bfcf81badb8b633d401c949e6 15094 web optional ledgersmb_1.6.9+ds-1+deb10u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEiol4ACgkQEMKTtsN8 Tjaj6Q//emxljrNJ/qkzrLegCv8Cx/cprXTvhilk2ql45OI74n4hNeYV6LLoVJWs T2VaG+QQSjHUXA18YSWhumHJdQc15Z5FlGD1QxgDuQh9yzLkonXthI6vykGbDsSs 1Fb6FYHBXphz5q5rLbFdqlaoVEcalKJpaMPNDZxh61Z9KjAiOIiUmPTKDxecz8Ro nL2E6UjyoKeX64CtVGT/jd2QOFXK6ego21oYFZZxGsHU5hPwqlC5f1aYXec6nBNz PGMSsvuQoBkVzkjjeqpELeu+TzniVD3savNNYLwbEB0ghEFsVJV7AvREkAG0/6WD Gi1+f3WG//WJfqLTQqniVw5tDEkso7fSJXPkXp2hv1yQ4fCBnGbfGtEw5sQnMIKe 5ZjmhNg9SbWXYP7Q3s9j/IFXsgXhfdumzYW/ym+TIcOEcXtPewbJ4qS9YFy3+4vR aksSOMqeOQBYYS8cWoSk9xlt/01MU2XTrxlIMPZbKztoE5UbYi2eYTDSu7gjc3Rn 6AqcaU1vIkcTEC/2BpnQJwizIPpwTyN86INWMa3XSFKMIy1HAJ41zWEDN/BOoAI5 DDe0vGkjqs3o6JQ5rRfxXq9Y3PkXiWmvI2FKRsVVNPZn0yao4TCEAKVWZKc8Xo9s MtA6N4bnky8RDQPsmIDwKd9O8BvuN9VAkf17V8vgEYx89JMxooA= =hShF -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-1+deb10u1_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates
by Debian FTP Masters 27 Aug '21

27 Aug '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 19 Aug 2021 21:04:51 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-1+deb10u1 Distribution: buster-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-1+deb10u1) buster-security; urgency=medium . * Fix CVE-2021-3693 and CVE-2021-3694, thanks to Erik Huelsmann Checksums-Sha1: 3669a256a11320037b67c0b2f129c4e691ee0325 3265 ledgersmb_1.6.9+ds-1+deb10u1.dsc efa19d0a485ff3b7795b8ce965fdedb6ad37d20e 1961328 ledgersmb_1.6.9+ds.orig.tar.xz 872d9d026f228229d0208216a7a2f0e13094aa30 37608 ledgersmb_1.6.9+ds-1+deb10u1.debian.tar.xz ca78d7a16fcae63d1d4d1178b4bf8598bf2f690a 15094 ledgersmb_1.6.9+ds-1+deb10u1_amd64.buildinfo Checksums-Sha256: 0ae418267d121a9a7d08723ca5333794a6196891613760355c038765dbb1f894 3265 ledgersmb_1.6.9+ds-1+deb10u1.dsc 7e29702482dd84ab30caf176bbdf56b7069db488b36c921b4ff57878ab1b579b 1961328 ledgersmb_1.6.9+ds.orig.tar.xz 4e00afff36715a9f43e3e0b3ddbcb4f17844c2df5ff8da0b36d10e638bceff29 37608 ledgersmb_1.6.9+ds-1+deb10u1.debian.tar.xz 0dbcaabcf453d5dbf3bd67c84539b9aabbafa7f050df75d64ff0b2d2bcf38bec 15094 ledgersmb_1.6.9+ds-1+deb10u1_amd64.buildinfo Files: 3830971b3cefbb644b940d61ba4ed749 3265 web optional ledgersmb_1.6.9+ds-1+deb10u1.dsc 1502debde292e73ab9e27e35c2f9fc23 1961328 web optional ledgersmb_1.6.9+ds.orig.tar.xz 11c73d8120d2d51a761d5b550da6c7ab 37608 web optional ledgersmb_1.6.9+ds-1+deb10u1.debian.tar.xz e1c38e333c7f604c155f74a2dcca7b76 15094 web optional ledgersmb_1.6.9+ds-1+deb10u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEerfQACgkQEMKTtsN8 TjYzBhAAl04KouFB15/h6vQx9IN5x4eD6CEmJ22KkeDMiw1J95b34aMPubVT4oKa sGp4y8DMeRF68Etz5FIKt3yiQm21u8/znwgXbKjHW4AsPTn0AkLMJgzmpGpauKHG 1MH3+8JF8SS5J5h4IXX7fQ4aZSz1EEaBZ7A9m/aNt2c5pQqhr58DtMV05ShTeA0j rMCevaS6qNCIwWNiCAuAylvGNMpMFtSHrrYSIX2aiBF8gdPv4TXX4FxeZhH1wYWp qQh4ugZzDP3PBUA8zU6KJtc5HR60xG+4ZDQn+7oviH1984kRpX6St4IvzPaBjd1f c1bfWAvdF84+Io1r0rSu6dshxqXALvpQYzyQe5rRgSic7AMhDahs9fBDWCW5iQ6K NoZ5f5OWWRb1uHbZrPXz/YIb/IrAw3HF2sfAZNaNXFT4wsn++urAoJ9m+sEtFBI5 +EJ9o+YrzGRPU4Kjj9e619u+VkhMdW4LEJKZzpqQyNug3we61ryyqLb4b0OizDsy xMb9DqbtxDpCMqIaTyzUvMyHdHToWhPir/K9fIo0X35Mbvmo6H/0f0jh8qdEOwp0 KG6+7qysj56hWrJnMUKNMkeGRRO36QDtH7SEGu/1CndYX1/QWGMqxYJ4e2FWc7O5 mnGufYVZ8aOIxgrHS5vFokpJ3iIXgDE69Wcnk/fHPHTXCs9H70Q= =hb6q -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-2+deb11u1_amd64.changes ACCEPTED into proposed-updates->stable-new, proposed-updates
by Debian FTP Masters 27 Aug '21

27 Aug '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 19 Aug 2021 21:02:41 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u1 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u1) bullseye-security; urgency=medium . * Fix CVE-2021-3693 and CVE-2021-3694, thanks to Erik Huelsmann Checksums-Sha1: 6358d0205896d5495af0d10afd0278662805c2f7 3265 ledgersmb_1.6.9+ds-2+deb11u1.dsc efa19d0a485ff3b7795b8ce965fdedb6ad37d20e 1961328 ledgersmb_1.6.9+ds.orig.tar.xz 012e22908ac7aa864d55b18e04c1781630e0ab1c 37688 ledgersmb_1.6.9+ds-2+deb11u1.debian.tar.xz 58b08afd4dc63418ff250ee10622691f12b963c1 15403 ledgersmb_1.6.9+ds-2+deb11u1_amd64.buildinfo Checksums-Sha256: 3a528065c4fb2f114758b7fc4858575745ff5c6c20e67488a8a9141e9d201393 3265 ledgersmb_1.6.9+ds-2+deb11u1.dsc 7e29702482dd84ab30caf176bbdf56b7069db488b36c921b4ff57878ab1b579b 1961328 ledgersmb_1.6.9+ds.orig.tar.xz d0e2d29e530156dd3320969bdffbdf7214548655d0cbef469f2402e72bd0b491 37688 ledgersmb_1.6.9+ds-2+deb11u1.debian.tar.xz 4c2842fac4587cfe794b1b391220e8854c8c7aa9200b3eb4d643f72a56c3fbf3 15403 ledgersmb_1.6.9+ds-2+deb11u1_amd64.buildinfo Files: 7b032e00006c0ef39aba509878dfa5be 3265 web optional ledgersmb_1.6.9+ds-2+deb11u1.dsc 1502debde292e73ab9e27e35c2f9fc23 1961328 web optional ledgersmb_1.6.9+ds.orig.tar.xz f2dc1cdf5b8a879712074217b1af6fd5 37688 web optional ledgersmb_1.6.9+ds-2+deb11u1.debian.tar.xz ad24d01a28bc6a1815c11eeef37915f7 15403 web optional ledgersmb_1.6.9+ds-2+deb11u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEerboACgkQEMKTtsN8 TjZ0sg//doFqnweItuKlfSC1Sph7e9640dTDufWJMM2wbaXrv6+Nu1yzU1W4V924 8eGFvS6byTl1alaaqHbwBnnf8qUkByl0Ik/21C9WRjFpehEhzyD/E9HtHMPbcA53 hORO44tLu4DqDv8GzBPA2OqfZ3B1E9VQZVurTkiJ7EiN1YYwJxiKL890WlbI4C21 +rh5PXdoiGVKKO7XGZbBu4zLi1R4prqp+ZS/X1X8o0egBvg3wttgt9bcxemHklmF zN9SaV3VQgbu7NUf02GdnUQir+AEVuBRCYBKK4j3qJKuDMQfjfoKoiWGDWQI5414 0TuTFc6sWLWjKeeb1YeJQL+u/zG0T3072sJx493xE2TlWYRmWDLen8p2fTpBs+Xi oVhErEaqpNPt12Y+IjvD1J8+7QnftHPU6mu6A2TlByZRlJoqT1nhn1IRk53GxBWv ghTF/+ytZgPUeJtFGoGyGDD3zlV8A08/JXs3odgxB30NQ5eNHmNUasx87oFF6c4b EpqmK9oBh9Xecg4BBeAu4C3U6HUOGpbUrBOCe+CC/9O6SSHdEUN2mGR6Qx/DZd6R snXWxZbxGXWIbyKxDLa3ozzrH6zOK/pHO3zRO8EjuWmRzCGXcDHfKylnrKiSCj7F XV3ymOK4HmtwF41b1RUylBfITjs/xlZGKqpBhpPufOnlx8/Y0MI= =KrHn -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-2+deb11u2_amd64.changes ACCEPTED into proposed-updates->stable-new, proposed-updates
by Debian FTP Masters 27 Aug '21

27 Aug '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 22 Aug 2021 20:58:22 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u2 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u2) bullseye-security; urgency=medium . * Fix CVE-2021-3731, thanks to Erik Huelsmann Checksums-Sha1: 1caa4a12de710bccd847c072d8a506324ce0a15b 3265 ledgersmb_1.6.9+ds-2+deb11u2.dsc 5cf961dc46eb35dd90b7eb150a08c733df8cfd22 37856 ledgersmb_1.6.9+ds-2+deb11u2.debian.tar.xz 8cc837669f71379c38e4e04e2f67f7409dc80f90 15403 ledgersmb_1.6.9+ds-2+deb11u2_amd64.buildinfo Checksums-Sha256: 3566ceca633c5b303878fa7514371b91efba39bf56e358401d231466ee8b9c23 3265 ledgersmb_1.6.9+ds-2+deb11u2.dsc cd5107b0d44919ae9688660c09606b3eb1dc1bac4ae4c5a88ad217f337494700 37856 ledgersmb_1.6.9+ds-2+deb11u2.debian.tar.xz f4125f7b988c70a436f5827adf261d7e3ec0f4094e9c44c38fc4f83f8276c2e2 15403 ledgersmb_1.6.9+ds-2+deb11u2_amd64.buildinfo Files: 2a7d93f94ca34d0e93ecaed95450f48a 3265 web optional ledgersmb_1.6.9+ds-2+deb11u2.dsc 2c7143557b2245b2d9845a9bd2914bb6 37856 web optional ledgersmb_1.6.9+ds-2+deb11u2.debian.tar.xz 5e6a533dbd1618edda2898e1ff65ae07 15403 web optional ledgersmb_1.6.9+ds-2+deb11u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEiojAACgkQEMKTtsN8 TjbEMRAAgMWAf1hUttem/G3KH9/mO3AwTCbd6Ta8vemOi4oCgK/nCDX/PgIvmRTf Px/RcdkuGVD1n9cM1uZggHtLnN0FN36sP/QdH/p+dtxpSuJ8OH1hXLPOGrgR8mWL 8u3IPwdrNMzcGCLtPWpf23Hf9rQRm/y1cwpuQJeFiwq5hf2jR0V56rgga2c1IMJf qDULyTjCMdalNF3xYbKhxG2IA7jQZjELsc/i3EWKXyMo4BQvMWDWKqMqaOzJ8+yy MXJi8BRCE/0CvMGrM5sFLWaOOzgCEjWNx6FYKl7kW5H8tJUdB1HpKFfvqqe8lDpi OPumZ8PhQ3a2B7nYp21NCjUfAFacoRYgXu6w/j3RgHC+6Kdllpm7hhhc58AYebHT VST9wdzvFV/BGDYYBM3HgcWocgD0oaTgNnKxyi1sbvnkr131GUuz97sRDv2RUu19 jk62FvmmKwgVSUErAygZt8PyVyyUQawveaPJAo8p0AaAjg0iN24O7px/LPO/R99P RcjnylOuZFVgxbY4v1afazO63YVki6iI3M9j2Tnx7bGDhXwEDjbk5TxypMamctK3 MvI+5hBLR9JCENVURLT3e4Kblzl6dz4VHT/piNCSyHucLYcgHtMwxsfXEZKOvOuO S4LpBhzToECtO+UPWtD/ql4hlmPjShAI0aAgQmHfgzLKmBfuZZE= =yY+z -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

LedgerSMB 1.8.19 released
by Erik Huelsmann 25 Aug '21

25 Aug '21

Unfortunately, the fixes for the security vulnerabilities released on Monday August 23 regressed some functionalities. This release fixes those regressions: Changelog for 1.8.19 * Follow-up for the fix to CVE-2021-3693; fix bulk-posting payments * Follow-up for the fix to CVE-2021-3693; fix incorrectly backported change For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.19/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.19 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.19 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.19 These are the sha256 checksums of the uploaded files: 4f818690b39a974680c6264727ddf3ab445a5db780294cad407869d54ed1fb0c ledgersmb-1.8.19.tar.gz ffc79cb40181b2cf94fcda63afdfaa2b63fd1703502a86f4bbb76a7bfdcb37a0 ledgersmb-1.8.19.tar.gz.asc

1 0

LedgerSMB 1.7.34 released
by Erik Huelsmann 25 Aug '21

25 Aug '21

Unfortunately, the fixes for the security vulnerabilities released on Monday August 23 regressed some functionalities. This release fixes those regressions: Changelog for 1.7.34 * Follow-up to fix for CVE-2021-3693 to fix display of search results * Follow-up for the fix to CVE-2021-3693; fix bulk-posting payments For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.34/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.34 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.34 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.34 These are the sha256 checksums of the uploaded files: 729ad60745bb3af14249d5ed952ed8d0110788fd7ed444de1bab61a81c2b9450 ledgersmb-1.7.34.tar.gz e2beddf724b41603162c0263e24944bafeb2231917aeb094173274ee3671b6b1 ledgersmb-1.7.34.tar.gz.asc

1 0

ledgersmb_1.6.9+ds-2+deb11u2_amd64.changes ACCEPTED into proposed-updates->stable-new
by Debian FTP Masters 23 Aug '21

23 Aug '21

Mapping stable-security to proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 22 Aug 2021 20:58:22 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u2 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u2) bullseye-security; urgency=medium . * Fix CVE-2021-3731, thanks to Erik Huelsmann Checksums-Sha1: 1caa4a12de710bccd847c072d8a506324ce0a15b 3265 ledgersmb_1.6.9+ds-2+deb11u2.dsc 5cf961dc46eb35dd90b7eb150a08c733df8cfd22 37856 ledgersmb_1.6.9+ds-2+deb11u2.debian.tar.xz 8cc837669f71379c38e4e04e2f67f7409dc80f90 15403 ledgersmb_1.6.9+ds-2+deb11u2_amd64.buildinfo Checksums-Sha256: 3566ceca633c5b303878fa7514371b91efba39bf56e358401d231466ee8b9c23 3265 ledgersmb_1.6.9+ds-2+deb11u2.dsc cd5107b0d44919ae9688660c09606b3eb1dc1bac4ae4c5a88ad217f337494700 37856 ledgersmb_1.6.9+ds-2+deb11u2.debian.tar.xz f4125f7b988c70a436f5827adf261d7e3ec0f4094e9c44c38fc4f83f8276c2e2 15403 ledgersmb_1.6.9+ds-2+deb11u2_amd64.buildinfo Files: 2a7d93f94ca34d0e93ecaed95450f48a 3265 web optional ledgersmb_1.6.9+ds-2+deb11u2.dsc 2c7143557b2245b2d9845a9bd2914bb6 37856 web optional ledgersmb_1.6.9+ds-2+deb11u2.debian.tar.xz 5e6a533dbd1618edda2898e1ff65ae07 15403 web optional ledgersmb_1.6.9+ds-2+deb11u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEiojAACgkQEMKTtsN8 TjbEMRAAgMWAf1hUttem/G3KH9/mO3AwTCbd6Ta8vemOi4oCgK/nCDX/PgIvmRTf Px/RcdkuGVD1n9cM1uZggHtLnN0FN36sP/QdH/p+dtxpSuJ8OH1hXLPOGrgR8mWL 8u3IPwdrNMzcGCLtPWpf23Hf9rQRm/y1cwpuQJeFiwq5hf2jR0V56rgga2c1IMJf qDULyTjCMdalNF3xYbKhxG2IA7jQZjELsc/i3EWKXyMo4BQvMWDWKqMqaOzJ8+yy MXJi8BRCE/0CvMGrM5sFLWaOOzgCEjWNx6FYKl7kW5H8tJUdB1HpKFfvqqe8lDpi OPumZ8PhQ3a2B7nYp21NCjUfAFacoRYgXu6w/j3RgHC+6Kdllpm7hhhc58AYebHT VST9wdzvFV/BGDYYBM3HgcWocgD0oaTgNnKxyi1sbvnkr131GUuz97sRDv2RUu19 jk62FvmmKwgVSUErAygZt8PyVyyUQawveaPJAo8p0AaAjg0iN24O7px/LPO/R99P RcjnylOuZFVgxbY4v1afazO63YVki6iI3M9j2Tnx7bGDhXwEDjbk5TxypMamctK3 MvI+5hBLR9JCENVURLT3e4Kblzl6dz4VHT/piNCSyHucLYcgHtMwxsfXEZKOvOuO S4LpBhzToECtO+UPWtD/ql4hlmPjShAI0aAgQmHfgzLKmBfuZZE= =yY+z -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-2+deb11u1_amd64.changes ACCEPTED into proposed-updates->stable-new
by Debian FTP Masters 23 Aug '21

23 Aug '21

Mapping stable-security to proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 19 Aug 2021 21:02:41 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u1 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u1) bullseye-security; urgency=medium . * Fix CVE-2021-3693 and CVE-2021-3694, thanks to Erik Huelsmann Checksums-Sha1: 6358d0205896d5495af0d10afd0278662805c2f7 3265 ledgersmb_1.6.9+ds-2+deb11u1.dsc efa19d0a485ff3b7795b8ce965fdedb6ad37d20e 1961328 ledgersmb_1.6.9+ds.orig.tar.xz 012e22908ac7aa864d55b18e04c1781630e0ab1c 37688 ledgersmb_1.6.9+ds-2+deb11u1.debian.tar.xz 58b08afd4dc63418ff250ee10622691f12b963c1 15403 ledgersmb_1.6.9+ds-2+deb11u1_amd64.buildinfo Checksums-Sha256: 3a528065c4fb2f114758b7fc4858575745ff5c6c20e67488a8a9141e9d201393 3265 ledgersmb_1.6.9+ds-2+deb11u1.dsc 7e29702482dd84ab30caf176bbdf56b7069db488b36c921b4ff57878ab1b579b 1961328 ledgersmb_1.6.9+ds.orig.tar.xz d0e2d29e530156dd3320969bdffbdf7214548655d0cbef469f2402e72bd0b491 37688 ledgersmb_1.6.9+ds-2+deb11u1.debian.tar.xz 4c2842fac4587cfe794b1b391220e8854c8c7aa9200b3eb4d643f72a56c3fbf3 15403 ledgersmb_1.6.9+ds-2+deb11u1_amd64.buildinfo Files: 7b032e00006c0ef39aba509878dfa5be 3265 web optional ledgersmb_1.6.9+ds-2+deb11u1.dsc 1502debde292e73ab9e27e35c2f9fc23 1961328 web optional ledgersmb_1.6.9+ds.orig.tar.xz f2dc1cdf5b8a879712074217b1af6fd5 37688 web optional ledgersmb_1.6.9+ds-2+deb11u1.debian.tar.xz ad24d01a28bc6a1815c11eeef37915f7 15403 web optional ledgersmb_1.6.9+ds-2+deb11u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEerboACgkQEMKTtsN8 TjZ0sg//doFqnweItuKlfSC1Sph7e9640dTDufWJMM2wbaXrv6+Nu1yzU1W4V924 8eGFvS6byTl1alaaqHbwBnnf8qUkByl0Ik/21C9WRjFpehEhzyD/E9HtHMPbcA53 hORO44tLu4DqDv8GzBPA2OqfZ3B1E9VQZVurTkiJ7EiN1YYwJxiKL890WlbI4C21 +rh5PXdoiGVKKO7XGZbBu4zLi1R4prqp+ZS/X1X8o0egBvg3wttgt9bcxemHklmF zN9SaV3VQgbu7NUf02GdnUQir+AEVuBRCYBKK4j3qJKuDMQfjfoKoiWGDWQI5414 0TuTFc6sWLWjKeeb1YeJQL+u/zG0T3072sJx493xE2TlWYRmWDLen8p2fTpBs+Xi oVhErEaqpNPt12Y+IjvD1J8+7QnftHPU6mu6A2TlByZRlJoqT1nhn1IRk53GxBWv ghTF/+ytZgPUeJtFGoGyGDD3zlV8A08/JXs3odgxB30NQ5eNHmNUasx87oFF6c4b EpqmK9oBh9Xecg4BBeAu4C3U6HUOGpbUrBOCe+CC/9O6SSHdEUN2mGR6Qx/DZd6R snXWxZbxGXWIbyKxDLa3ozzrH6zOK/pHO3zRO8EjuWmRzCGXcDHfKylnrKiSCj7F XV3ymOK4HmtwF41b1RUylBfITjs/xlZGKqpBhpPufOnlx8/Y0MI= =KrHn -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

LedgerSMB 1.8.18 released
by Erik Huelsmann 23 Aug '21

23 Aug '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains three fixes for security vulnerabilities. Users are urged to upgrade as soon as possible. Special thanks go to "ranjit-git", and sudheendra17, users of the https://huntr.dev/ platform, for disclosing these issues responsibly to the development team. And to the platform itself for sponsoring the work of these researchers. This release contains the following fixes and improvements: Changelog for 1.8.18 * Check whether HTML comes from a valid source; CVE-2021-3693 * Apply HTML escaping on error messages; CVE-2021-3694 (#5754) * Fix several issues in `bin/prepare-company-database` (#5769) * Prevent the application being wrapped in a frame; CVE-2021-3731 For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.18/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.18 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.18 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.18 These are the sha256 checksums of the uploaded files: c3ed50b78a0cebc6ef7edfab6a5b1c7b6b5b2f5545bf2d680ad6c3f6cbca5be2 ledgersmb-1.8.18.tar.gz 133fae3563fa1be3eb4cd48ec06347187ba165bbeeb854c92ed03d9c08111ae0 ledgersmb-1.8.18.tar.gz.asc

1 0

ledgersmb_1.6.9+ds-1+deb10u2_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new
by Debian FTP Masters 23 Aug '21

23 Aug '21

Mapping oldstable-security to oldstable-proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 22 Aug 2021 20:54:25 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-1+deb10u2 Distribution: buster-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-1+deb10u2) buster-security; urgency=medium . * Fix CVE-2021-3731, thanks for Erik Huelsmann Checksums-Sha1: 81dff0043e075588fffb234efda4b78b641f5449 3265 ledgersmb_1.6.9+ds-1+deb10u2.dsc 851b39c25748d2a780895f8c2a450b94e53ac31e 37796 ledgersmb_1.6.9+ds-1+deb10u2.debian.tar.xz a3db94b57cf7fcdedaf9197ed8be469f2e673934 15094 ledgersmb_1.6.9+ds-1+deb10u2_amd64.buildinfo Checksums-Sha256: bc167a97c2e63a4c72882bb7d82a39cf79b56f51c3dabd330713922a5b4c7c2d 3265 ledgersmb_1.6.9+ds-1+deb10u2.dsc aef28aa91470f89a51ad87f14e8f6da13c9a79340fd96124a0e5f5c77ab80120 37796 ledgersmb_1.6.9+ds-1+deb10u2.debian.tar.xz bff4d79e7d88353b98a696bd2b6f16b3064c3e3716c4b401a4e19375c383dd5c 15094 ledgersmb_1.6.9+ds-1+deb10u2_amd64.buildinfo Files: 0fd6e172a26caf3ba19491665415ad32 3265 web optional ledgersmb_1.6.9+ds-1+deb10u2.dsc 630ed153ca2cbdddaffee480eead3ea7 37796 web optional ledgersmb_1.6.9+ds-1+deb10u2.debian.tar.xz 8349333bfcf81badb8b633d401c949e6 15094 web optional ledgersmb_1.6.9+ds-1+deb10u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEiol4ACgkQEMKTtsN8 Tjaj6Q//emxljrNJ/qkzrLegCv8Cx/cprXTvhilk2ql45OI74n4hNeYV6LLoVJWs T2VaG+QQSjHUXA18YSWhumHJdQc15Z5FlGD1QxgDuQh9yzLkonXthI6vykGbDsSs 1Fb6FYHBXphz5q5rLbFdqlaoVEcalKJpaMPNDZxh61Z9KjAiOIiUmPTKDxecz8Ro nL2E6UjyoKeX64CtVGT/jd2QOFXK6ego21oYFZZxGsHU5hPwqlC5f1aYXec6nBNz PGMSsvuQoBkVzkjjeqpELeu+TzniVD3savNNYLwbEB0ghEFsVJV7AvREkAG0/6WD Gi1+f3WG//WJfqLTQqniVw5tDEkso7fSJXPkXp2hv1yQ4fCBnGbfGtEw5sQnMIKe 5ZjmhNg9SbWXYP7Q3s9j/IFXsgXhfdumzYW/ym+TIcOEcXtPewbJ4qS9YFy3+4vR aksSOMqeOQBYYS8cWoSk9xlt/01MU2XTrxlIMPZbKztoE5UbYi2eYTDSu7gjc3Rn 6AqcaU1vIkcTEC/2BpnQJwizIPpwTyN86INWMa3XSFKMIy1HAJ41zWEDN/BOoAI5 DDe0vGkjqs3o6JQ5rRfxXq9Y3PkXiWmvI2FKRsVVNPZn0yao4TCEAKVWZKc8Xo9s MtA6N4bnky8RDQPsmIDwKd9O8BvuN9VAkf17V8vgEYx89JMxooA= =hShF -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

ledgersmb_1.6.9+ds-1+deb10u1_amd64.changes ACCEPTED into oldstable-proposed-updates->oldstable-new
by Debian FTP Masters 23 Aug '21

23 Aug '21

Mapping oldstable-security to oldstable-proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 19 Aug 2021 21:04:51 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-1+deb10u1 Distribution: buster-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-1+deb10u1) buster-security; urgency=medium . * Fix CVE-2021-3693 and CVE-2021-3694, thanks to Erik Huelsmann Checksums-Sha1: 3669a256a11320037b67c0b2f129c4e691ee0325 3265 ledgersmb_1.6.9+ds-1+deb10u1.dsc efa19d0a485ff3b7795b8ce965fdedb6ad37d20e 1961328 ledgersmb_1.6.9+ds.orig.tar.xz 872d9d026f228229d0208216a7a2f0e13094aa30 37608 ledgersmb_1.6.9+ds-1+deb10u1.debian.tar.xz ca78d7a16fcae63d1d4d1178b4bf8598bf2f690a 15094 ledgersmb_1.6.9+ds-1+deb10u1_amd64.buildinfo Checksums-Sha256: 0ae418267d121a9a7d08723ca5333794a6196891613760355c038765dbb1f894 3265 ledgersmb_1.6.9+ds-1+deb10u1.dsc 7e29702482dd84ab30caf176bbdf56b7069db488b36c921b4ff57878ab1b579b 1961328 ledgersmb_1.6.9+ds.orig.tar.xz 4e00afff36715a9f43e3e0b3ddbcb4f17844c2df5ff8da0b36d10e638bceff29 37608 ledgersmb_1.6.9+ds-1+deb10u1.debian.tar.xz 0dbcaabcf453d5dbf3bd67c84539b9aabbafa7f050df75d64ff0b2d2bcf38bec 15094 ledgersmb_1.6.9+ds-1+deb10u1_amd64.buildinfo Files: 3830971b3cefbb644b940d61ba4ed749 3265 web optional ledgersmb_1.6.9+ds-1+deb10u1.dsc 1502debde292e73ab9e27e35c2f9fc23 1961328 web optional ledgersmb_1.6.9+ds.orig.tar.xz 11c73d8120d2d51a761d5b550da6c7ab 37608 web optional ledgersmb_1.6.9+ds-1+deb10u1.debian.tar.xz e1c38e333c7f604c155f74a2dcca7b76 15094 web optional ledgersmb_1.6.9+ds-1+deb10u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEerfQACgkQEMKTtsN8 TjYzBhAAl04KouFB15/h6vQx9IN5x4eD6CEmJ22KkeDMiw1J95b34aMPubVT4oKa sGp4y8DMeRF68Etz5FIKt3yiQm21u8/znwgXbKjHW4AsPTn0AkLMJgzmpGpauKHG 1MH3+8JF8SS5J5h4IXX7fQ4aZSz1EEaBZ7A9m/aNt2c5pQqhr58DtMV05ShTeA0j rMCevaS6qNCIwWNiCAuAylvGNMpMFtSHrrYSIX2aiBF8gdPv4TXX4FxeZhH1wYWp qQh4ugZzDP3PBUA8zU6KJtc5HR60xG+4ZDQn+7oviH1984kRpX6St4IvzPaBjd1f c1bfWAvdF84+Io1r0rSu6dshxqXALvpQYzyQe5rRgSic7AMhDahs9fBDWCW5iQ6K NoZ5f5OWWRb1uHbZrPXz/YIb/IrAw3HF2sfAZNaNXFT4wsn++urAoJ9m+sEtFBI5 +EJ9o+YrzGRPU4Kjj9e619u+VkhMdW4LEJKZzpqQyNug3we61ryyqLb4b0OizDsy xMb9DqbtxDpCMqIaTyzUvMyHdHToWhPir/K9fIo0X35Mbvmo6H/0f0jh8qdEOwp0 KG6+7qysj56hWrJnMUKNMkeGRRO36QDtH7SEGu/1CndYX1/QWGMqxYJ4e2FWc7O5 mnGufYVZ8aOIxgrHS5vFokpJ3iIXgDE69Wcnk/fHPHTXCs9H70Q= =hb6q -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

LedgerSMB 1.7.33 released
by Erik Huelsmann 23 Aug '21

23 Aug '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains three fixes for security vulnerabilities. Users are urged to upgrade as soon as possible. Special thanks go to "ranjit-git", and sudheendra17, users of the https://huntr.dev/ platform, for disclosing these issues responsibly to the development team. And to the platform itself for sponsoring the work of these researchers. This release contains the following fixes and improvements: Changelog for 1.7.33 * Check whether HTML comes from a valid source; CVE-2021-3693 * Apply HTML escaping on error messages; CVE-2021-3694 (#5766) * Prevent the application being wrapped in a frame; CVE-2021-3731 * Align filters between UI and the database on draft transaction search (#5693) * Correctly present manual tax and invoice total on reversing invoice (#5721) * Repeatedly saving a draft invoice pops up an SQL error (#5679) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.33/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.33 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.33 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.33 These are the sha256 checksums of the uploaded files: 15dcc79a42fd17f12d01e1cc4b36ddd25e8dbe776ffe1b9867a1ad9e42bfabc0 ledgersmb-1.7.33.tar.gz 73eadc3bf2c2b3d2abeabe52ccc3db03dd5e46599d4a84a3a72ef10105d6ab36 ledgersmb-1.7.33.tar.gz.asc

1 0

[SECURITY] Advisory for clickjacking vulnerability CVE-2021-3731
by Erik Huelsmann 23 Aug '21

23 Aug '21

On August 20th, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Insufficient protection against 'clickjacking' Summary: ======== LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking. This allows an attacker to trick a targetted user to execute unintended actions. Known vulnerable: ================= All of: - 1.1.0 upto 1.1.12 (including) - 1.2.0 upto 1.2.26 (including) - 1.3.0 upto 1.3.47 (including) - 1.4.0 upto 1.4.42 (including) - 1.5.0 upto 1.5.30 (including) - 1.6.0 upto 1.6.33 (including) - 1.7.0 upto 1.7.32 (including) - 1.8.0 upto 1.8.17 (including) Known fixed: ============ - 1.7.33 - 1.8.18 Details: ======== In a clickjacking attack, an attacker (invisibly) wraps the vulnerable site in his own site, carefully placing elements of his own site over elements of the wrapped site, tricking the user into performing unintended actions on the vulnerable site. More information on clickjacking is on the OWASP page at https://owasp.org/www-community/attacks/Clickjacking The lack of protection dates back to version 1.0, although it must be noted that mitigation measures were first available in browsers as of 2011 -- the year of the release of 1.3.0. Severity: ========= CVSSv3.1 Base Score: 5.9 (Medium) CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.7 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade, may apply the included patches or are advised to contact a vendor for custom support. As a workaround, administrators may configure their webservers to add the Content-Security-Policy header as documented in the content security policy site at https://content-security-policy.com/#server. References: =========== CVE-2021-3731 (LedgerSMB) https://ledgersmb.org/cve-2021-3731-clickjacking https://huntr.dev/bounties/5664331d-f5f8-4412-8566-408f8655888a/ Reported by: ============ sudheendra17, user of the huntr.dev platform Patches: ======== Patch for LedgerSMB 1.8 (1.8.0 upto 1.8.17, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index b0b20a95b..a4785a9f1 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -122,6 +122,9 @@ sub old_app { return Plack::Util::response_cb( $handler->($env), sub { + Plack::Util::header_set($_[0]->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); if (not Plack::Util::header_exists($_[0]->[1], 'X-LedgerSMB-App-Content')) { Plack::Util::header_push($_[0]->[1], @@ -179,6 +182,9 @@ sub psgi_app { } }; + Plack::Util::header_set($res->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); return $res; } ]]] Patch for LedgerSMB 1.7 (1.7.0 upto 1.7.32, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index ec8be07f1..bcb478524 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -91,6 +91,9 @@ sub old_app { return Plack::Util::response_cb( $handler->(@_), sub { + Plack::Util::header_set($_[0]->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); if (not Plack::Util::header_exists($_[0]->[1], 'X-LedgerSMB-App-Content')) { Plack::Util::header_push($_[0]->[1], @@ -159,6 +162,9 @@ sub psgi_app { } }; + Plack::Util::header_set($res->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); return $res; } ]]] -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

[SECURITY] Advisory for cross site scripting security vulnerability CVE-2021-3694
by Erik Huelsmann 23 Aug '21

23 Aug '21

On August 4th, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Reflected cross-site scripting of authenticated users in LedgerSMB Summary: ======== LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure. Known vulnerable: ================= All of: - 1.1.0 upto 1.1.12 (including) - 1.2.0 upto 1.2.26 (including) - 1.3.0 upto 1.3.47 (including) - 1.4.0 upto 1.4.42 (including) - 1.5.0 upto 1.5.30 (including) - 1.6.0 upto 1.6.33 (including) - 1.7.0 upto 1.7.32 (including) - 1.8.0 upto 1.8.17 (including) Known fixed: ============ - 1.7.33 - 1.8.18 Details: ======== When encountering an error, LedgerSMB sends the user feedback which may include user-provided input. This input was not sufficiently sanitized before being included in the error report. This allows an attacker inject a script in the error response page by send a specially crafted URL to an authenticated user. As the error page itself does not contain any sensitive information, a sophisticated payload in addition to targetting a sufficiently privileged user, is required for information disclosure. Proper audit control and separation of duties limit Integrity impact of the attack vector. The vulnerable code to provide this user-feedback dates back to version 1.0. Please note that not error messages are vulnerable to this attack as not all messages report the problematic input to the user. Severity: ========= CVSSv3.1 Base Score: 8.2 (High) CVSSv3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.7 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade, may apply the included patches or are advised to contact a vendor for custom support. There are no workarounds available for this vulnerability. References: =========== CVE-2021-3694 (LedgerSMB) https://ledgersmb.org/cve-2021-3694-cross-site-scripting https://huntr.dev/bounties/ef7f4cf7-3a81-4516-b261-f5b6ac21430c/ Reported by: ============ ranjit-git, user of the huntr.dev platform Patches: ======== Patch for LedgerSMB 1.8 (1.8.0 upto 1.8.17, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI/Util.pm b/lib/LedgerSMB/PSGI/Util.pm index 11c01918f..bf443d886 100644 --- a/lib/LedgerSMB/PSGI/Util.pm +++ b/lib/LedgerSMB/PSGI/Util.pm @@ -24,6 +24,7 @@ use strict; use warnings; use Carp; +use HTML::Escape; use HTTP::Status qw( HTTP_OK HTTP_INTERNAL_SERVER_ERROR HTTP_SEE_OTHER HTTP_BAD_REQUEST ); @@ -41,7 +42,7 @@ Returns a standard error representation for HTTP status 500 sub internal_server_error { - my ($msg, $title, $company, $dbversion) = @_; + my ($msg, $title, $company, $dbversion) = map { escape_html($_ // '') } @_; $title //= 'Error!'; $msg =~ s/\n/<br>/g; diff --git a/old/lib/LedgerSMB/oldHandler.pm b/old/lib/LedgerSMB/oldHandler.pm index 1db966406..848eeb75c 100644 --- a/old/lib/LedgerSMB/oldHandler.pm +++ b/old/lib/LedgerSMB/oldHandler.pm @@ -57,6 +57,7 @@ use LedgerSMB::Sysconfig; use Cookie::Baker; use Digest::MD5; +use HTML::Escape; use Log::Log4perl; use Try::Tiny; @@ -184,14 +185,17 @@ sub handle { sub _error { my ($form, $msg, $status) = @_; $msg = "? _error" if !defined $msg; + my $html_msg = escape_html($msg); + my $html_dbversion = escape_html($form->{dbversion}); + my $html_company = escape_html($form->{company}); $status = 500 if ! defined $status; print qq|Status: $status ISE Content-Type: text/html; charset=utf-8 <html> -<body><h2 class="error">Error!</h2> <p><b>$msg</b></p> -<p>dbversion: $form->{dbversion}, company: $form->{company}</p> +<body><h2 class="error">Error!</h2> <p><b>$html_msg</b></p> +<p>dbversion: $html_dbversion, company: $html_company</p> </body> </html> |; ]]] Patch for LedgerSMB 1.7 (1.7.0 upto 1.7.32, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI/Util.pm b/lib/LedgerSMB/PSGI/Util.pm index 2d6195d69..b716a01c4 100644 --- a/lib/LedgerSMB/PSGI/Util.pm +++ b/lib/LedgerSMB/PSGI/Util.pm @@ -24,6 +24,7 @@ use strict; use warnings; use Carp; +use HTML::Escape; use HTTP::Status qw( HTTP_OK HTTP_INTERNAL_SERVER_ERROR HTTP_SEE_OTHER HTTP_UNAUTHORIZED ); @@ -41,7 +42,7 @@ Returns a standard error representation for HTTP status 500 sub internal_server_error { - my ($msg, $title, $company, $dbversion) = @_; + my ($msg, $title, $company, $dbversion) = map { escape_html($_ // '') } @_; $title //= 'Error!'; $msg =~ s/\n/<br>/g; diff --git a/old/bin/old-handler.pl b/old/bin/old-handler.pl index 24fa7a0a0..87864fc7e 100644 --- a/old/bin/old-handler.pl +++ b/old/bin/old-handler.pl @@ -187,14 +187,16 @@ $form->{dbh}->disconnect() if defined $form->{dbh}; sub _error { my ($form, $msg, $status) = @_; $msg = "? _error" if !defined $msg; + my $html_msg = escape_html($msg); + my $html_dbversion = escape_html($form->{dbversion}); + my $html_company = escape_html($form->{company}); $status = 500 if ! defined $status; print qq|Status: $status ISE Content-Type: text/html; charset=utf-8 - <html> -<body><h2 class="error">Error!</h2> <p><b>$msg</b></p> -<p>dbversion: $form->{dbversion}, company: $form->{company}</p> +<body><h2 class="error">Error!</h2> <p><b>$html_msg</b></p> +<p>dbversion: $html_dbversion, company: $html_company</p> </body> </html> |; ]]] -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

[SECURITY] Advisory for cross site scripting security vulnerability CVE-2021-3693
by Erik Huelsmann 23 Aug '21

23 Aug '21

On August 4th, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. DOM cross-site scripting of authenticated users in LedgerSMB Summary: ======== LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure. Known vulnerable: ================= All of: - 1.5.0 upto 1.5.30 (including) - 1.6.0 upto 1.6.33 (including) - 1.7.0 upto 1.7.32 (including) - 1.8.0 upto 1.8.17 (including) Known fixed: ============ - 1.7.33 - 1.8.18 Details: ======== LedgerSMB uses the URL's hash fragment (the part after the '#'-sign) to store which screen the user is on, for the purpose of history navigation (the back button). The hash fragment is assumed to be a URL that is part of the web application's URL space. This assumption is not verified. This allows an attacker inject a script into the page by send a specially crafted URL to an authenticated user. As the process of loading the attack payload overwrites any content in the main window, the attack by itself does not expose sensitive information; a sophisticated payload in addition to targetting a sufficiently privileged user, is required for information disclosure. Proper audit control and separation of duties limit Integrity impact of the attack vector. The vulnerable code dates back to version 1.5 when LedgerSMB moved to the Single Page Application (SPA) model for web applications. Severity: ========= CVSSv3.1 Base Score: 7.1 (High) CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.7 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade, may apply the included patches or are advised to contact a vendor for custom support. There are no workarounds available for this vulnerability. References: =========== CVE-2021-3693 (LedgerSMB) https://ledgersmb.org/cve-2021-3693-cross-site-scripting https://huntr.dev/bounties/daf1384d-648a-43fd-9b35-5c37d8ead667/ Reported by: ============ ranjit-git, user of the huntr.dev platform Patches: ======== Patch for LedgerSMB 1.8 (1.8.0 upto 1.8.17, including): ------------------------------------------------------- [[[ diff --git a/UI/js-src/lsmb/MainContentPane.js b/UI/js-src/lsmb/MainContentPane.js index 9c0d6113c..ebfa36f05 100644 --- a/UI/js-src/lsmb/MainContentPane.js +++ b/UI/js-src/lsmb/MainContentPane.js @@ -7,8 +7,8 @@ define([ "dojo/dom-style", "dojo/_base/lang", "dojo/promise/Promise", + "dojo/Deferred", "dojo/promise/all", - "dojo/request/xhr", "dojo/query", // "dojo/request/iframe", "dojo/dom-class" @@ -19,12 +19,21 @@ define([ domStyle, lang, Promise, + Deferred, all, - xhr, query, // iframe, domClass ) { + var docURL = new URL(document.location); + var domReject = function (request) { + return ( + request.getResponseHeader("X-LedgerSMB-App-Content") !== "yes" || + (request.getResponseHeader("Content-Disposition") || "").startsWith( + "attachment" + ) + ); + }; return declare("lsmb/MainContentPane", [ContentPane], { last_page: null, interceptClick: null, @@ -74,17 +83,62 @@ define([ ); }, load_form: function (url, options) { + var tgt = new URL(url, docURL); + if (tgt.origin !== docURL.origin) { + return new Deferred().resolve(); + } + var self = this; self.fade_main_div(); - return xhr(url, options).then( - function (doc) { - self.hide_main_div(); - self.set_main_div(doc); - }, - function (err) { - self.show_main_div(); - self.report_request_error(err); - } + var req = new XMLHttpRequest(); + var dfd = new Deferred(function () { + req.abort(); + }); + try { + req.open(options.method || "GET", tgt); + var headers = options.headers; + for (var hdr in headers || {}) { + req.setRequestHeader(hdr, headers[hdr]); + } + if ( + options.data && + !(options.data instanceof FormData) && + !headers["Content-Type"] + ) { + req.setRequestHeader( + "Content-Type", + "application/x-www-form-urlencoded" + ); + } + req.setRequestHeader("X-Requested-With", "XMLHttpRequest"); + req.addEventListener("load", function () { + dfd.resolve(req); + }); + req.addEventListener("error", function () { + dfd.reject(req); + }); + req.send(options.data || ""); + } catch (e) { + dfd.reject(e); + } + + return dfd.then( + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + + self.hide_main_div(); + return self.set_main_div(request.response); + }, + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + + self.show_main_div(); + return self.report_request_error({ err: request }); + } ); }, download_link: function (/*href*/) { diff --git a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm index 99a964548..07f2feb34 100644 --- a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm +++ b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm @@ -29,6 +29,7 @@ use HTTP::Status qw/ HTTP_REQUEST_ENTITY_TOO_LARGE /; use List::Util qw{ none any }; use Module::Runtime qw/ use_module /; use Plack::Request; +use Plack::Util; use Plack::Util::Accessor qw( script script_name module ); use LedgerSMB::PSGI::Util; @@ -91,7 +92,15 @@ sub call { $env->{'lsmb.script_name'} = $self->script_name; $env->{'lsmb.action'} = $action; $env->{'lsmb.action_name'} = $action_name; - return $self->app->($env); + return Plack::Util::response_cb( + $self->app->($env), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); } diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index 26b4ec6b3..b0b20a95b 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -119,7 +119,15 @@ sub old_app { my $env = shift; local $psgi_env = $env; - return $handler->($env); + return Plack::Util::response_cb( + $handler->($env), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); } } ]]] Patch for LedgerSMB 1.7 (1.7.0 upto 1.7.32, including): ------------------------------------------------------- [[[ diff --git a/UI/js-src/lsmb/MainContentPane.js b/UI/js-src/lsmb/MainContentPane.js index 17ac8d391..5bc1bd4fa 100644 --- a/UI/js-src/lsmb/MainContentPane.js +++ b/UI/js-src/lsmb/MainContentPane.js @@ -6,6 +6,7 @@ define([ "dojo/dom-style", "dojo/_base/lang", "dojo/promise/Promise", + "dojo/Deferred", "dojo/on", "dojo/hash", "dojo/promise/all", @@ -15,8 +16,14 @@ define([ "dojo/dom-class" ], function(ContentPane, declare, event, registry, style, - lang, Promise, on, hash, all, xhr, query, iframe, + lang, Promise, Deferred, on, hash, all, xhr, query, iframe, domClass) { + var docURL = new URL(document.location); + var domReject = function (request) { + return ( + request.getResponseHeader("X-LedgerSMB-App-Content") !== "yes" || + (request.getResponseHeader("Content-Disposition") || "").startsWith("attachment")); + }; return declare("lsmb/MainContentPane", [ContentPane], { @@ -56,17 +63,61 @@ define([ }); }, load_form: function(url, options) { + var tgt = new URL(url, docURL); + if (tgt.origin !== docURL.origin) { + return (new Deferred()).resolve(); + } + var self = this; self.fade_main_div(); - return xhr(url, options).then( - function(doc){ + var req = new XMLHttpRequest(); + var dfd = new Deferred(function () { + req.abort(); + }); + try { + req.open(options.method || "GET", tgt); + var headers = options.headers || {}; + for (var hdr in headers) { + req.setRequestHeader(hdr, headers[hdr]); + } + if (options.data && + !(options.data instanceof FormData) && + ! headers["Content-Type"]) { + req.setRequestHeader( + "Content-Type", + "application/x-www-form-urlencoded" + ); + } + req.setRequestHeader("X-Requested-With", "XMLHttpRequest"); + req.addEventListener("load", function () { + dfd.resolve(req); + }); + req.addEventListener("error", function () { + dfd.reject(req); + }); + req.send(options.data || ""); + } catch (e) { + dfd.reject(e); + } + + return dfd.then( + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + self.hide_main_div(); - self.set_main_div(doc); + return self.set_main_div(request.response); }, - function(err){ + function (request) { + if (domReject(request)) { + return self.show_main_div(); + } + self.show_main_div(); - self.report_request_error(err); - }); + return self.report_request_error({ err: request }); + } + ); }, download_link: function(href) { // while it would have been nice for the code below diff --git a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm index 94737a25d..6964798a5 100644 --- a/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm +++ b/lib/LedgerSMB/Middleware/DynamicLoadWorkflow.pm @@ -28,6 +28,7 @@ use parent qw ( Plack::Middleware ); use List::Util qw{ none any }; use Module::Runtime qw/ use_module /; use Plack::Request; +use Plack::Util; use LedgerSMB::PSGI::Util; @@ -95,7 +96,15 @@ sub call { $env->{'lsmb.script_name'} = $script_name; $env->{'lsmb.action'} = $action; $env->{'lsmb.action_name'} = $action_name; - return $self->app->($env); + return Plack::Util::response_cb( + $self->app->($env), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); } diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index 328e80ad3..ec8be07f1 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -78,7 +78,7 @@ Returns a 'PSGI app' which handles requests for the 'old-code' scripts in old/bi =cut sub old_app { - return CGI::Emulate::PSGI->handler( + my $handler = CGI::Emulate::PSGI->handler( sub { my $uri = $ENV{REQUEST_URI}; $uri =~ s/\?.*//; @@ -86,6 +86,18 @@ sub old_app { _run_old(); }); + + return sub { + return Plack::Util::response_cb( + $handler->(@_), + sub { + if (not Plack::Util::header_exists($_[0]->[1], + 'X-LedgerSMB-App-Content')) { + Plack::Util::header_push($_[0]->[1], + 'X-LedgerSMB-App-Content', 'yes'); + } + }); + } } ]]] -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.8.17 released
by Erik Huelsmann 28 Jul '21

28 Jul '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.17 * Align filters between UI and the database on draft transaction search (#5692) * Correctly present manual tax and invoice total on reversing invoice (#5721) * Repeatedly saving a draft invoice pops up an SQL error (#5679) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.17/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.17 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.17 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.17 These are the sha256 checksums of the uploaded files: b1eabf07226041216fe286b68d7204b2ac7925bef56140bc15b2897587e247c9 ledgersmb-1.8.17.tar.gz fcb5994b391716b8c8c51b04977717ca9d8df5edd8789a864d1afdb380a683c5 ledgersmb-1.8.17.tar.gz.asc

1 0