galaxy-announce

Download

galaxy-announce@lists.galaxyproject.org

November 2017

1 participants
2 discussions

GX-2017-0005: Unauthorized data libraries access
by Martin Čech 15 Nov '17

15 Nov '17

*DESCRIPTION* A medium severity security vulnerability in Galaxy data libraries has been discovered. This vulnerability allows anyone able to access Galaxy's API to add to their history any data library dataset that they know an id of. This vulnerability has been assigned the disclosure ID GX-2017-0005. *AFFECTED VERSIONS* This vulnerability affects all versions of Galaxy released since at least 2011. *IMPACT* Given the ids of library datasets are presented encoded it is not easy to exploit this vulnerability in a targeted manner. However all Galaxy objects are enumerated incrementally so there are means to generate and/or guess valid ids of existing library datasets and read them. *SOLUTION* Per our security policies[1], we have created fixes for versions of Galaxy starting with 16.07. These have been committed to the corresponding `release_YY.MM` (and `dev`) branches in the Galaxy GitHub repository. Releases prior to 16.07 will remain vulnerable and should be updated to a supported release as soon as possible. *INSTRUCTIONS* The fixes are available on the `release_16.07` through `release_17.09` and `dev` branches in the Galaxy GitHub repository[2]. You can simply `git pull` or use your normal update procedure to get the changes. For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. Martin (on behalf of the Galaxy Committers) [1] https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md [2] https://github.com/galaxyproject/galaxy/

1 0

Release of Galaxy 17.09
by Martin Čech 02 Nov '17

02 Nov '17

Dear Galaxy Fans, The release* of Galaxy **17.09* is out. Thanks to the #usegalaxy committers and you, our community! *Full *release * notes: * https://docs.galaxyproject.org/en/master/releases/17.09_announce.html Highlights: *Singularity - *Tool execution using the HPC-friendly container technology Singularity is now supported. Custom containers can be specified by the Galaxy admin on a per job destination basis or standardized containers corresponding to Conda requirements can be built or downloaded automatically using the mulled toolkit built into Galaxy (just like is possible for Docker). For more information checkout presentation at http://jmchilton.github.io/writing/gcc2017slides/biocontainers.html from the 2017 Galaxy Community Conference. *Download entire collection - *Downloading whole colections is now possible from the history interface. Thanks to @mvdbeek. *Switch tool versions in workflows - *You can now select exactly what version of tool you want to use when building workflows.Thanks to @mvdbeek. *Thanks for using Galaxy!* *http://galaxyproject.org <http://galaxyproject.org>*

1 0