January 2015 - galaxy-announce - lists.galaxyproject.org

Galactic News!!! February 2015 Edition
by Dave Clements 30 Jan '15

30 Jan '15

1 0

GCC2015 Training Day Topic Voting is open. Please vote!
by Dave Clements 19 Jan '15

19 Jan '15

Hello all,What topics should be offered at the GCC2015 Training Day <http://gcc2015.tsl.ac.uk/training-day/>? Topics <http://gcc2015.tsl.ac.uk/training-day/> for the GCC2015 Training Day <http://gcc2015.tsl.ac.uk/training-day/> are selected by you, the Galaxy Community. There are nominated topics <http://gcc2015.tsl.ac.uk/training-day/> spanning from basic usage to advanced deployment. No matter what you do with Galaxy, there are topics for you to choose from. Your vote will determine the topics that are offered, which topics should be offered more than once, and which ones should not be scheduled at the same time. Your vote matters. *Topic voting closes 30 January.* The Training Day schedule, including instructors, will be published before early registration opens in February. *Vote Now <http://gcc2015.tsl.ac.uk/training-day/>* ------------------------------ *About the GCC2015 Training Day <http://gcc2015.tsl.ac.uk/training-day/>:* The 2015 Galaxy Community Conference (GCC2015) <http://gcc2015.tsl.ac.uk/> will start on 6 July with a Training Day <http://gcc2015.tsl.ac.uk/training-day/> featuring parallel tracks, each with several multi-hour workshops. There will be at least one complete track about using Galaxy for biological research, and at least one full track on deploying and managing Galaxy instances. As always, please let us know if you have any questions. Thanks, The GCC2015 Organising Committee <http://gcc2015.tsl.ac.uk/organisers/> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Galaxy security vulnerabilities and 2015.01.13 Galaxy Stable Release
by Nate Coraor 13 Jan '15

13 Jan '15

A number of security vulnerabilities were recently discovered by Bartlomiej Balcerek and colleagues at the Wroclaw Centre for Networking and Supercomputing, which have been fixed in the current stable Galaxy release (2014.10.06). We have simultaneously created a new stable release (2015.01.13) today which includes these fixes as well as new features. Galaxy server administrators are STRONGLY encouraged to update their Galaxy servers to one of these releases immediately. The first vulnerability identified would allow a malicious person to execute arbitrary code on a Galaxy server. The vulnerability is due to gaps in Galaxy's command line template parameter sanitization. Although all form fields were sanitized for shell metacharacters, some other parameters that might be provided to tools on the command line (such as the input dataset name) were not. Because of this, dataset names and other fields could be constructed to exploit this vulnerability. Due to the severity of this specific vulnerability, the fix for it has been applied back to previous releases beginning with the January 13, 2013 release. The fix can be obtained by executing `hg pull && hg update latest_<YYYY>.<MM>.<DD>`, replacing the date with the date of the release currently in use. In addition to the code execution exploit, a number of cross-site scripting (XSS) vulnerabilities were identified by Bartlomiej which we have fixed in our new and previous stable releases. We only backport fixes for exploits that we believe allow an attacker to readily gain access to the Galaxy server to previous stable releases - nonetheless we consider these XSS vulnerabilities to be serious and would strongly recommend that public servers upgrade to at least the previous stable release, using the latest_2014.10.06 tag, to address them. The Galaxy Team also performed an audit to locate and fix any additional XSS vulnerabilities that might exist. Additional details on issues found and resolved can be found in the January 13, 2015 Galaxy Distribution News Brief at: https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13 To get the changes, for example, if you are running release_2014.10.06 (or a subsequent commit to the stable branch of Galaxy between release_2014.10.06 and release_2015.01.13), you can update with: % hg pull % hg update latest_2014.10.06 For the changes to take effect, YOU MUST RESTART ALL GALAXY SERVER PROCESSES. The Galaxy Team would like to extend special thanks to Bartlomiej Balcerek and colleagues, who privately disclosed the arbitrary code execution and XSS vulnerabilities, with a full report and proof of concepts. Credit for the arbitrary code execution fix goes to my fellow Galaxy Team member Daniel Blankenberg. The entire team worked to resolve the identified XSS issues and conduct the larger code audit. On behalf of the Galaxy Team, --nate

1 0

January 13, 2015 Galaxy Distribution
by Jennifer Hillman-Jackson 13 Jan '15

13 Jan '15

*January 13, 2015 Galaxy Distribution* <https://wiki.galaxyproject.org/News/2014_01_13_Galaxy_Distribution> [image: width=175] <http://getgalaxy.org/> *Complete News Brief <http://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13>* Security Several *critical* security vulnerabilities were recently discovered by Bartlomiej Balcerek and colleagues at the Wroclaw Centre for Networking and Supercomputing. This stable Galaxy release contains fixes for those vulnerabilities <https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13#Security>. *The Galaxy Team strongly encourages Galaxy server administrators to update their Galaxy servers immediately.* IPython Integration Thanks to the awesome work of community members Björn Grüning and Eric Rasche, Galaxy now features integration with the popular IPython project <https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13#IPython_Integration>. The Galaxy-IPython <https://github.com/bgruening/galaxy-ipython> project has been merged into Galaxy core and made into a generic plugin framework of interactive environments based on Docker. Tool Form Upgrade (for Beta Testing) In Galaxy's development branch, the basic tool from has been redesigned and modernized to address certain limitations in Galaxy's responsiveness when working with longer forms containing multiple parameter choices <https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13#Tool_Form_Upgrade_.…>. This new tool form will become the default with the next release - but we are hoping tool author's and power users enable it and provide feedback during this release cycle in order to ensure it is working ideally when it becomes the default. Get The Distribution [image: getgalaxy] <http://getgalaxy.org/> *getgalaxy.org <http://wiki.galaxyproject.org/Admin/GetGalaxy>* *galaxy-dist.readthedocs.org <http://galaxy-dist.readthedocs.org/>* *bitbucket.org/galaxy/galaxy-dist <http://bitbucket.org/galaxy/galaxy-dist>* *new*: $ hg clone https://bitbucket.org/galaxy/galaxy-dist#stable *upgrade*: $ hg pull $ hg update latest_2015.01.13 *Thanks for using Galaxy!* The Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- Jennifer Hillman-Jackson http://galaxyproject.org

1 0

GCC2015 Training Day Topic Nominations are Open through January 6
by Dave Clements 05 Jan '15

05 Jan '15

Hello all, GCC2015 Training Day <http://gcc2015.tsl.ac.uk/training-day/> topics are nominated by you <http://bit.ly/gcc2015tdnom>, the Galaxy Community. Please take a few minutes to nominate a topic. Any topic of interest to the Galaxy Community can be nominated and you are encouraged to nominate more than one. If you are looking for ideas, see the topics nominated in 2013 <http://bit.ly/1i2j1gN> and 2014 <http://bit.ly/1s6NtMN>, and the Events <https://wiki.galaxyproject.org/Events> and the Events Archives <https://wiki.galaxyproject.org/Events/Archive> pages. Nominated topics will be published on the Training Day <http://gcc2015.tsl.ac.uk/training-day/> page as they come in. *Nominations close 6 January*. Topics will be compiled into a uniform list by the GCC2015 Organising Committee <http://gcc2015.tsl.ac.uk/organisers>, and topics will be voted on by the Galaxy Community 12-23 January. Topics will then be selected and scheduled based on topic interest, and the organisers' ability to confirm instructors for each session. Some very popular sessions may be scheduled more than once. The final schedule will be posted before registration opens. Cheers, GCC2015 Organising Committee <http://gcc2015.tsl.ac.uk/organisers> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 1

January 2015 Galaxy News!
by Dave Clements 05 Jan '15

05 Jan '15

1 0