- galaxy-announce - lists.galaxyproject.org

GX-2017-0003: Unauthorized filesystem access via data source tools
by Nate Coraor 23 Oct '17

23 Oct '17

*DESCRIPTION* A medium severity security vulnerability in tools utilizing the Galaxy data source protocol was recently discovered by Dan Blankenberg. This vulnerability allows anyone able to run an external data source tool to add to their history any file that is readable by the user running Galaxy jobs on the host where the job runs. This is due to the Python urllib library's ability to operate on `file://` URLs and a failure to check for such URLs in the tool. This vulnerability has been assigned the disclosure ID GX-2017-0003. *AFFECTED VERSIONS* This vulnerability affects all known versions of Galaxy. *IMPACT* Many such "external data source" tools are provided with the Galaxy distribution and are enabled by default (most tools under the "Get Data" section of the tool panel), meaning that its exploitability is fairly high, as only one such tool needs to be enabled to be vulnerable, including any custom data source tools (any tool that uses `tools/data_source/data_source.py`). What files will be readable depends entirely upon what the job's user has access to read on the host(s) where jobs run. *SOLUTION* Per our security policies[1], we have created fixes for all affected versions of Galaxy. These have been committed to the corresponding `release_YY.MM` (and `dev`) branches in the Galaxy GitHub repository. Releases prior to 16.07 will remain vulnerable and should be updated to a supported release as soon as possible. Eric Rasche recently undertook a hardening of the Galaxy code base against common security mishaps.[2] This included changing most uses of `urllib` to `requests`, which does not operate on `file://` URLs. Although no exploits were identified at that time, we felt this work was of great enough importance to production Galaxy servers that we backported it to releases from 16.07 forward. Because of this, and the GX-2017-0001 and GX-2017-0002 vulnerabilities, administrators are strongly encouraged to update immediately, even if they do not believe their servers are vulnerable. *INSTRUCTIONS* The fixes are available on the `release_16.07` through `release_17.09` and `dev` branches in the Galaxy GitHub repository[3]. You can simply `git pull` or use your normal update procedure to get the changes. For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. --nate (on behalf of the Galaxy Committers) [1] https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md [2] https://github.com/galaxyproject/galaxy/pull/4604 [3] https://github.com/galaxyproject/galaxy/

1 0

GX-2017-0002: Arbitrary code execution for Galaxy servers with Galaxy Interactive Environments enabled
by Nate Coraor 23 Oct '17

23 Oct '17

*DESCRIPTION* A high severity security vulnerability was recently discovered in Galaxy Interactive Environments (GIEs) by the Galaxy Committers Team. Anyone with a Galaxy account can exploit this vulnerability to execute arbitrary code on the Galaxy server as the user running the Galaxy server process. This is possible due to incorrect quoting of user-provided data passed to a shell execution context for the GIE `docker run` command. This vulnerability has been assigned the disclosure ID GX-2017-0002. *AFFECTED VERSIONS* This vulnerability affects Galaxy version 17.05 and later that have been configured to enable Galaxy Interactive Environments. *IMPACT* The vulnerability only affects Galaxy servers on which Galaxy Interactive Environments are enabled (by setting the `interactive_environment_plugins_directory` option in galaxy.ini). Because the vulnerability can be exploited to execute arbitrary code, the impact for affected servers is severe. Administrators of Galaxy servers where GIEs *are* enabled should update immediately. Administrators of Galaxy servers where GIEs are *not* enabled *should* update their servers to ensure they are not vulnerable should they enable GIEs at a later date, however, it is not critical to do so immediately. *SOLUTION* Per our security policies[1], we have created fixes for all affected versions of Galaxy. These have been committed to the corresponding `release_YY.MM` (and `dev`) branches in the Galaxy GitHub repository. The fix switches from using shell execution to direct execution with exec(3) and therefore is not susceptible to shell escaping exploits *INSTRUCTIONS* The fixes are available on the `release_17.05`, `release_17.09`, and `dev` branches in the Galaxy GitHub repository[2]. You can simply `git pull` or use your normal update procedure to get the changes. For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. --nate (on behalf of the Galaxy Committers) [1] https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md [2] https://github.com/galaxyproject/galaxy/

1 0

GX-2017-0001: Limited Galaxy Data Library unauthorized filesystem access
by Nate Coraor 23 Oct '17

23 Oct '17

*DESCRIPTION* A medium severity security vulnerability in Galaxy Data Libraries was recently discovered by Jelle Scholtalbers, and in the course of investigating this vulnerability, we discovered multiple related attack vectors. This vulnerability allows the following unauthorized actions: 1. Any user that has been granted the permission to add datasets to a library, library folder, or to modify an existing library dataset (an "authorized user"), is able to import any file on the system that is readable by the user running the Galaxy server. 2. Anyone can create libraries and library folders (but not add datasets to them) This is possible due to incorrect checking of admin privileges and for symbolic links in the user's `user_library_import_dir`. Neither case can be exploited directly through the Galaxy UI, but both can be exploited through the API. Case #1 is not exploitable by any user who is not an "authorized user" or if none of `library_import_dir`, `user_library_import_dir`, and `allow_path_paste` (formerly `allow_library_path_paste`) are set in galaxy.ini. This vulnerability has assigned the disclosure ID GX-2017-0001. *AFFECTED VERSIONS* This vulnerability affects all known versions of Galaxy. *IMPACT* The more severe vulnerability (reading arbitrary files) can only be exploited by users with elevated library privileges, so its exploitability is limited to users whom the Galaxy server admin(s) presumably know and trust. The creation of arbitrary libraries and folders is a nuisance, but not in and of itself a security issue. *SOLUTION* Per our security policies[1], we have implemented fixes for versions of Galaxy from 16.07 through the forthcoming 17.09. These have been committed to the corresponding `release_YY.MM` (and `dev`) branches in the Galaxy GitHub repository. Releases prior to 16.07 will remain vulnerable and should be updated to a supported release as soon as possible. If your user `user_library_import_dir` or any of its parents are symlinks, user library imports will fail. You should put the fully canonicalized absolute path in this galaxy.ini option. Because the fix disallows symlinks in `user_library_import_dir` which point outside the user's particular subdirectory, and because some Galaxy admins may have found this to be a useful ability, we have created a new `user_library_import_symlink_whitelist` option in galaxy.ini that allows admins to configure directories to which symlinks should be allowed. However, please be aware that *any* user with library add/modify privileges and the ability to create symbolic links will be able to import from any whitelisted directory. There is no per-user restriction for whitelisted directories. *INSTRUCTIONS* The fixes are available on the `release_16.07` through `release_17.09` and `dev` branches in the Galaxy GitHub repository[2]. You can simply `git pull` or use your normal update procedure to get the changes. For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. --nate (on behalf of the Galaxy Committers) [1] https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md [2] https://github.com/galaxyproject/galaxy/

1 0

October News: Hacktoberfest, Pubs and Pub News, Events, Openings, Servers, ....
by Dave Clements 02 Oct '17

02 Oct '17

1 0

September Galaxy Newsletter
by Dave Clements 06 Sep '17

06 Sep '17

1 0

August News: GCC2018: in Portland (w/ BOSC); GCC2017 & ISMB/BOSC presentations; and more
by Dave Clements 01 Aug '17

01 Aug '17

1 0

Release of Galaxy 17.05
by Jennifer Hillman-Jackson 12 Jun '17

12 Jun '17

Dear Galaxy Fans, We are pleased to announce the *release of Galaxy 17.05*. Thanks to the #usegalaxy committers and you, our community! Full release notes: https://docs.galaxyproject.org/en/master/releases/17.05_announce.html Highlights: *Tag your data with propagating hashtags* Large Galaxy histories used to be messy. Hashtags make it easy to track dataset (and collection) relationships. These two movies (both under a minute) explain how to use this with datasets <https://vimeo.com/216884518> and with collections <https://vimeo.com/216895965>. Learn more about Galaxy histories in our updated tutorial <https://galaxyproject.org/tutorials/histories/> *Drag & Drop datasets into tool inputs*Interface now allows dragging datasets from history panel into the content selectors of the tool form. Implemented in Pull Request 3871 <https://github.com/galaxyproject/galaxy/pull/3871>.*Upload directly to a collection* You can now bypass the history manipulation and upload your data straight into a collection for convenience. Learn more about collections and how to use them in a new tutorial <https://galaxyproject.org/tutorials/collections/>. We extend special thanks to the 64 New Contributors <https://docs.galaxyproject.org/en/master/releases/17.05_announce.html#new-c…> to Galaxy in the past year. *Thanks for using Galaxy!* *http://galaxyproject.org <http://galaxyproject.org>*

1 0

GCC2017: Talk schedule posted; Register by 16 June
by Dave Clements 08 Jun '17

08 Jun '17

Hello all, A few GCC2017 <https://gcc2017.sciencesconf.org/> things: 1) The presentation schedule <https://gcc2017.sched.com/> has been posted. 2) The poster and demo schedule will likely be posted later today 3) Lightning talk <https://gcc2017.sciencesconf.org/page/submit> and birds-of-a-feather <https://docs.google.com/forms/d/e/1FAIpQLSdRCs97OWt47qmMxWZAtSV3TTLJ24IhW0m…> submission are still open 4) There is still limited space available for late poster and computer demo submissions <https://gcc2017.sciencesconf.org/page/submit> 5) Register by 16 June <https://gcc2017.sciencesconf.org/page/registration> >From this point on most/all emails about GCC2017 will go only to those that have registered for it. The final announcement going out to non-Galaxy mailing lists is below. Please forward to anyone who you think might be interested. And, we do hope to see you in Montpellier! Dave C on behalf of the GCC2017 Organizing Committee -- 2017 Galaxy Community Conference (GCC2017) 26-30 June 2017 Montpellier, France https://gcc2017.sciencesconf.org/ https://gcc2017.sched.com/ -- The Galaxy Community Conference (GCC) <https://gcc2017.sciencesconf.org/> brings together researchers working in and supporting data intensive life science research. There is no better place to share your work and learn from others that are addressing diverse questions and facing common challenges in data intensive biology. GCC participants work across the tree of life, around the world, and represent universities, research organizations, industry, medical schools and research hospitals. GCC2017 will be in Montpellier, France, 26-30 June and features two days of presentations, discussions, poster sessions, lightning talks, computer demos, keynotes, and birds-of-a-feather meetups <https://gcc2017.sched.com/overview/type/Conference>, all about data-intensive biology and the tools that support it. GCC2017 also features data and coding hackathons <https://gcc2017.sciencesconf.org/page/hackathon>, and two days of training <https://gcc2017.sched.com/overview/type/Training> covering 16 different topics. GCC2017 will be held at Le Corum Conference Centre <http://www.montpellier-events.com/en/The-Corum/Presentation> in the heart of Montpellier <https://gcc2017.sciencesconf.org/resource/page/id/2>, just 10km from the Mediterranean. Registration closes 16 June <https://gcc2017.sciencesconf.org/page/registration>. Costs start at 75€ per day for postdocs and students. If you work in data intensive life science research then GCC2017 is an ideal opportunity to present your work. Lightning talk <https://gcc2017.sciencesconf.org/page/submit> and birds-of-a-feather <https://docs.google.com/forms/d/e/1FAIpQLSdRCs97OWt47qmMxWZAtSV3TTLJ24IhW0m…> submission are still open, and there is limited space available for late poster and computer demo submissions <https://gcc2017.sciencesconf.org/page/submit>. About Galaxy Galaxy <https://galaxyproject.org/> is an open, web-based platform for data-intensive biomedical analysis used by tens of thousands of researchers around the world. It supports ad hoc exploration and analysis through scalable and repeatable data analysis pipelines for large research studies. Galaxy is available in over 90 free and publicly accessible web servers, on public and national cloud infrastructures, and is locally installed at hundreds, if not thousands, of research organisations around the world. We hope to see you in Montpellier! Au revoir, The GCC2017 Organising Committee -- https://galaxyproject.org/ https://getgalaxy.org/ https://usegalaxy.org/ https://gcc2017.sciencesconf.org/

1 0

June 2017 News of the Galaxy
by Dave Clements 06 Jun '17

06 Jun '17

1 0

May 2017 Galaxy News: GCC2017 deadlines, sponsors & BoFs; new papers, openings, tutorials...
by Dave Clements 02 May '17

02 May '17

1 0