- users - lists.freelock.com

LedgerSMB 1.9.0-rc1 released
by Erik Huelsmann 18 Sep '21

18 Sep '21

Hi, As one of the last steps in the release process leading up to the release of 1.9.0, there's the release of 1.9.0-rc1, release candidate 1. This release is considered production ready and provided for general testing and last-minute bug feedback. The release notes for the 1.9.0 release apply to this release as well and can be found at https://ledgersmb.org/content/19-release-notes ; please report any issues with the release notes just as well as with the released software! The release is available as a docker image and can be run using the updated docker compose file at https://github.com/ledgersmb/ledgersmb-docker/blob/1.9/docker-compose.yml or with the docker command: $ docker pull ledgersmb/ledgersmb:1.9 The release tarball can be downloaded from our download site at https://download.ledgersmb.org/f/Beta Releases/1.9.0-rc1 Please provide your feedback in reply to this e-mail or as issues filed on the GitHub site at https://github.com/ledgersmb/LedgerSMB -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.8.21 released
by Erik Huelsmann 18 Sep '21

18 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.21 * Prevent draft approval by user without permission (#5984) * Fix UI consistency (missing CSS class) in purchase invoice (#5988) * Fix performance problem deleting huge draft transactions (#5993) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.21/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.21 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.21 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.21 These are the sha256 checksums of the uploaded files: d75d9d4dfbc4dadf02f0a25d3c64a22c348802ca3d926a8c550af4d705d90027 ledgersmb-1.8.21.tar.gz 6659d193b4922d6c11b8c09162484e15bd019e502aebc29faf4942809a997679 ledgersmb-1.8.21.tar.gz.asc

1 0

Problem moving from 1.7.35 to 1.8.13
by Louis 18 Sep '21

18 Sep '21

Hey all, I have not been able to move to the 1.8 series from the 1.7 series. I think I must not have authentication correct and the 1.8 is expecting a different setup than previous version. This is a starman installation. I will backup the DB, move the code into place and run setup.pl. Setup pops open an error reading: Localhost:5762 says Access denied (500): bad username/password I'm using the same credentials as with 1.7.35. I can roll back and forth easily, but I don't see what the debug path should be. Any help would be appreciated. Louis

2 1

LedgerSMB 1.8.20 released
by Erik Huelsmann 03 Sep '21

03 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.8.20 * Fix for chart of accounts headings import from CSV (#5987) * Correctly set the payment account in invoices and transactions (#5801) * Fix regression in CVE-2021-3693 failing to show errors as popups (#5921) * Fix regression in CVE-2021-3693 with broken downloads of backups (#5931) In addition to the above, it should be noted that the Docker images have been built with a new build procedure which provides better mapping of Perl dependencies to Debian packages. Due to this change, dependencies will be updated automatically. Should there be any issues with the images despite this improvement, please report to the GitHub issue tracker for the Docker images at: https://github.com/ledgersmb/ledgersmb-docker/issues For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.20/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.20 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.20 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.20 These are the sha256 checksums of the uploaded files: fd9c6dd36e656df592a2a241d1d3c1296e9fc45eb94610beccf5e0eab7db6541 ledgersmb-1.8.20.tar.gz 870128cf20b30f3b17d6d57ccbebd1769190ad72994ad28cd69e869b807d717e ledgersmb-1.8.20.tar.gz.asc

1 0

LedgerSMB 1.7.35 released
by Erik Huelsmann 03 Sep '21

03 Sep '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.35 * Fix for chart of accounts headings import from CSV (#5987) * Correctly set the payment account in invoices and transactions (#5801) * Fix regression in CVE-2021-3693 failing to show errors as popups (#5921) * Fix regression in CVE-2021-3693 with broken downloads of backups (#5931) In addition to the above, it should be noted that the Docker images have been built with a new build procedure which provides better mapping of Perl dependencies to Debian packages. Due to this change, dependencies will be updated automatically. Should there be any issues with the images despite this improvement, please report to the GitHub issue tracker for the Docker images at: https://github.com/ledgersmb/ledgersmb-docker/issues For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.35/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.35 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.35 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.35 These are the sha256 checksums of the uploaded files: ea291741c44c228b8a07e0bd738ada754457af5d9bee861e54057a42a5cd4512 ledgersmb-1.7.35.tar.gz 78e49149a015ac311d75367d88f23083da9648619f976bc17d3acbf165d8e5ce ledgersmb-1.7.35.tar.gz.asc

1 0

LedgerSMB 1.8.19 released
by Erik Huelsmann 25 Aug '21

25 Aug '21

Unfortunately, the fixes for the security vulnerabilities released on Monday August 23 regressed some functionalities. This release fixes those regressions: Changelog for 1.8.19 * Follow-up for the fix to CVE-2021-3693; fix bulk-posting payments * Follow-up for the fix to CVE-2021-3693; fix incorrectly backported change For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.19/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.19 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.19 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.19 These are the sha256 checksums of the uploaded files: 4f818690b39a974680c6264727ddf3ab445a5db780294cad407869d54ed1fb0c ledgersmb-1.8.19.tar.gz ffc79cb40181b2cf94fcda63afdfaa2b63fd1703502a86f4bbb76a7bfdcb37a0 ledgersmb-1.8.19.tar.gz.asc

1 0

LedgerSMB 1.7.34 released
by Erik Huelsmann 25 Aug '21

25 Aug '21

Unfortunately, the fixes for the security vulnerabilities released on Monday August 23 regressed some functionalities. This release fixes those regressions: Changelog for 1.7.34 * Follow-up to fix for CVE-2021-3693 to fix display of search results * Follow-up for the fix to CVE-2021-3693; fix bulk-posting payments For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.34/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.34 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.34 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.34 These are the sha256 checksums of the uploaded files: 729ad60745bb3af14249d5ed952ed8d0110788fd7ed444de1bab61a81c2b9450 ledgersmb-1.7.34.tar.gz e2beddf724b41603162c0263e24944bafeb2231917aeb094173274ee3671b6b1 ledgersmb-1.7.34.tar.gz.asc

1 0

LedgerSMB 1.8.18 released
by Erik Huelsmann 23 Aug '21

23 Aug '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains three fixes for security vulnerabilities. Users are urged to upgrade as soon as possible. Special thanks go to "ranjit-git", and sudheendra17, users of the https://huntr.dev/ platform, for disclosing these issues responsibly to the development team. And to the platform itself for sponsoring the work of these researchers. This release contains the following fixes and improvements: Changelog for 1.8.18 * Check whether HTML comes from a valid source; CVE-2021-3693 * Apply HTML escaping on error messages; CVE-2021-3694 (#5754) * Fix several issues in `bin/prepare-company-database` (#5769) * Prevent the application being wrapped in a frame; CVE-2021-3731 For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.8.18/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.8.18 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.8.18 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.8.18 These are the sha256 checksums of the uploaded files: c3ed50b78a0cebc6ef7edfab6a5b1c7b6b5b2f5545bf2d680ad6c3f6cbca5be2 ledgersmb-1.8.18.tar.gz 133fae3563fa1be3eb4cd48ec06347187ba165bbeeb854c92ed03d9c08111ae0 ledgersmb-1.8.18.tar.gz.asc

1 0

LedgerSMB 1.7.33 released
by Erik Huelsmann 23 Aug '21

23 Aug '21

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains three fixes for security vulnerabilities. Users are urged to upgrade as soon as possible. Special thanks go to "ranjit-git", and sudheendra17, users of the https://huntr.dev/ platform, for disclosing these issues responsibly to the development team. And to the platform itself for sponsoring the work of these researchers. This release contains the following fixes and improvements: Changelog for 1.7.33 * Check whether HTML comes from a valid source; CVE-2021-3693 * Apply HTML escaping on error messages; CVE-2021-3694 (#5766) * Prevent the application being wrapped in a frame; CVE-2021-3731 * Align filters between UI and the database on draft transaction search (#5693) * Correctly present manual tax and invoice total on reversing invoice (#5721) * Repeatedly saving a draft invoice pops up an SQL error (#5679) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.33/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.33 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.33 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.33 These are the sha256 checksums of the uploaded files: 15dcc79a42fd17f12d01e1cc4b36ddd25e8dbe776ffe1b9867a1ad9e42bfabc0 ledgersmb-1.7.33.tar.gz 73eadc3bf2c2b3d2abeabe52ccc3db03dd5e46599d4a84a3a72ef10105d6ab36 ledgersmb-1.7.33.tar.gz.asc

1 0

[SECURITY] Advisory for clickjacking vulnerability CVE-2021-3731
by Erik Huelsmann 23 Aug '21

23 Aug '21

On August 20th, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Insufficient protection against 'clickjacking' Summary: ======== LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking. This allows an attacker to trick a targetted user to execute unintended actions. Known vulnerable: ================= All of: - 1.1.0 upto 1.1.12 (including) - 1.2.0 upto 1.2.26 (including) - 1.3.0 upto 1.3.47 (including) - 1.4.0 upto 1.4.42 (including) - 1.5.0 upto 1.5.30 (including) - 1.6.0 upto 1.6.33 (including) - 1.7.0 upto 1.7.32 (including) - 1.8.0 upto 1.8.17 (including) Known fixed: ============ - 1.7.33 - 1.8.18 Details: ======== In a clickjacking attack, an attacker (invisibly) wraps the vulnerable site in his own site, carefully placing elements of his own site over elements of the wrapped site, tricking the user into performing unintended actions on the vulnerable site. More information on clickjacking is on the OWASP page at https://owasp.org/www-community/attacks/Clickjacking The lack of protection dates back to version 1.0, although it must be noted that mitigation measures were first available in browsers as of 2011 -- the year of the release of 1.3.0. Severity: ========= CVSSv3.1 Base Score: 5.9 (Medium) CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.7 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade, may apply the included patches or are advised to contact a vendor for custom support. As a workaround, administrators may configure their webservers to add the Content-Security-Policy header as documented in the content security policy site at https://content-security-policy.com/#server. References: =========== CVE-2021-3731 (LedgerSMB) https://ledgersmb.org/cve-2021-3731-clickjacking https://huntr.dev/bounties/5664331d-f5f8-4412-8566-408f8655888a/ Reported by: ============ sudheendra17, user of the huntr.dev platform Patches: ======== Patch for LedgerSMB 1.8 (1.8.0 upto 1.8.17, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index b0b20a95b..a4785a9f1 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -122,6 +122,9 @@ sub old_app { return Plack::Util::response_cb( $handler->($env), sub { + Plack::Util::header_set($_[0]->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); if (not Plack::Util::header_exists($_[0]->[1], 'X-LedgerSMB-App-Content')) { Plack::Util::header_push($_[0]->[1], @@ -179,6 +182,9 @@ sub psgi_app { } }; + Plack::Util::header_set($res->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); return $res; } ]]] Patch for LedgerSMB 1.7 (1.7.0 upto 1.7.32, including): ------------------------------------------------------- [[[ diff --git a/lib/LedgerSMB/PSGI.pm b/lib/LedgerSMB/PSGI.pm index ec8be07f1..bcb478524 100644 --- a/lib/LedgerSMB/PSGI.pm +++ b/lib/LedgerSMB/PSGI.pm @@ -91,6 +91,9 @@ sub old_app { return Plack::Util::response_cb( $handler->(@_), sub { + Plack::Util::header_set($_[0]->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); if (not Plack::Util::header_exists($_[0]->[1], 'X-LedgerSMB-App-Content')) { Plack::Util::header_push($_[0]->[1], @@ -159,6 +162,9 @@ sub psgi_app { } }; + Plack::Util::header_set($res->[1], + 'Content-Security-Policy', + q{frame-ancestors 'self'}); return $res; } ]]] -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0