- galaxy-announce - lists.galaxyproject.org

Announcing the October 2016 (v16.10) Galaxy Release
by Nate Coraor 15 Dec '16

15 Dec '16

The Galaxy Committers team <https://github.com/galaxyproject/galaxy/blob/dev/doc/source/project/organiz…> is pleased to announce the *October 2016 (v16.10) release of Galaxy <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html>*. Security <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html#secur…> An arbitrary code execution vulnerability in two tools and an XSS vulnerability with the upload tool were identified this release cycle and have been fixed concurrently with the release. In addition, the fixes have been backported to older releases. The Galaxy Committers would like to thank David Wyde for disclosing these vulnerabilities. Details follow: 1. The vulnerable tools are “Filter GFF data by attribute” and “Filter GFF data by feature count”, both of which are provided with and enabled by default in the Galaxy server. These two tools share code with each other and the more general “Filter data on any column using simple expressions” tool. The latter was fixed in a previous security disclosure but these GFF variants of the tool were missed when updating the Filter tool. These tools use the Python eval and exec functions and do not properly sanitize input to these functions. The fix for this issue has been applied to Galaxy releases back to v14.10 and can be found in Commit c1e3087 2. An uploaded file’s name was not properly sanitized, and so a specially crafted filename uploaded to the Galaxy server could be used as an XSS attack vector. The fix for this issue has been applied to Galaxy releases back to v16.07 and can be found in Pull Request 3278. Highlighted Enhancements <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html#highl…> - Overhaul of charts visualization - more visualizations, more options, and better user interface. - Paginate contents of large histories. - Implement a collection operation tool for merging collections (thanks to @Takadonet). - Replace reference documentation for tool XML files with automatically generated documentation from a now official Galaxy XSD documentation (with help from many). - Add a password strength evaluation bar (thanks to @benfulton). - Implement a GoDocker job runner (thanks to @varunshankar). - Support for API batch requests. - Allow JSONP to be returned from API endpoints. - Add “Save as” as an option in the workflow editor (thanks to @tmcgowan). - Allow naming input datasets and collections during workflow extraction. - Various enhancements for API driven installation of tool shed repositories. Get Galaxy <http://getgalaxy.org/> The code lives at Github <https://github.com/galaxyproject/galaxy> and you should have Git <https://git-scm.com/> to obtain it. *To get a new Galaxy repository run:* $ git clone -b release_16.10 https://github.com/galaxyproject/galaxy.git *To update an existing Galaxy repository run:* $ git checkout release_16.10 && git pull --ff-only origin release_16.10 Release Notes <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html> For full details on all of the enhancements and fixes in this release, please see the full release notes <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html>. On behalf of the Galaxy Committers <https://github.com/galaxyproject/galaxy/blob/dev/doc/source/project/organiz…> , *Thanks for using Galaxy!* --nate

1 0

Galaxy Security Vulnerability - Arbitrary code execution
by Nate Coraor 15 Dec '16

15 Dec '16

*DESCRIPTION* A security vulnerability was recently discovered by David Wyde in two Galaxy tools that are provided with and enabled by default in the Galaxy server. These vulnerabilities allow malicious actors to execute arbitrary code as the user running the Galaxy server. The vulnerable tools are "Filter GFF data by attribute" and "Filter GFF data by feature count", two tools which share code with each other and the more general "Filter data on any column using simple expressions" tool. The latter was fixed in a previous security disclosure but these GFF variants of the tool were missed when updating the Filter tool. These tools use the Python `eval` and `exec` functions and do not properly sanitize input to these functions. Additionally, an XSS vulnerability with the upload tool: An uploaded file's name was not properly sanitized, and so a specially crafted filename uploaded to the Galaxy server could be used as an XSS attack vector. This vulnerability has already been fixed in the 16.07 and 16.10 Galaxy releases. The Galaxy Committers would like to thank David for disclosing these vulnerabilities. If you discover security vulnerabilities in Galaxy, please report them to the Galaxy Committers at galaxy-committers(a)lists.galaxyproject.org. *AFFECTED VERSIONS* These arbitrary code execution vulnerability is present in all known releases of Galaxy using the default tool config or a tool config in which these tools are loaded. To determine if your Galaxy server is affected, check your tool_conf.xml for the following lines: <tool file="filters/gff/gff_filter_by_attribute.xml" /> <tool file="filters/gff/gff_filter_by_feature_count.xml" /> If you are unsure, you can also check to see if the tools have loaded by searching for them in your Galaxy server logs, e.g.: % grep gff_filter paster.log galaxy.tools.toolbox.base DEBUG 2016-12-08 13:25:16,930 Loaded tool id: gff_filter_by_attribute, version: 0.1 into tool panel.. galaxy.tools.toolbox.base DEBUG 2016-12-08 13:25:16,930 Loaded tool id: gff_filter_by_feature_count, version: 0.1 into tool panel.. *IMPACT* This vulnerability can be exploited to execute arbitrary code as the user that runs Galaxy jobs on any system where Galaxy runs those jobs (potentially a cluster). Such code can be used to provide a remote shell to an attacker, or read/write/delete files that the Galaxy user has appropriate permissions on. *SOLUTION* Multiple solutions exist for the arbitrary code execution vulnerability: 1. Update your Galaxy code. A fix for the issue has been applied to stable releases of Galaxy back to version 14.10. 2. Disable the affected tools. 3. Patch the affected tools. Patches to fix the vulnerabilities (depending on the version of Galaxy that you are running) can be found below. *INSTRUCTIONS* 1. To apply the fix, first identify your current Galaxy release version using the `git branch` command. If you are on a 'release_YY.MM' branch, you can update with: % git pull The process above can also be used to update to the 16.10 release if you are on the 'master' git branch. If you are on the 'master' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git fetch origin % git checkout -b release_YY.MM origin/release_YY.MM % git pull 2. To disable the tools, locate and remove the following lines from your tool_conf.xml, then restart Galaxy: <tool file="filters/gff/gff_filter_by_attribute.xml" /> <tool file="filters/gff/gff_filter_by_feature_count.xml" /> 3. To manually patch the tools, use the appropriate patch file below: For Galaxy releases 16.01 to dev: https://depot.galaxyproject.org/patch/filter_security_16_01.patch For Galaxy releases 15.07 to 15.10: https://depot.galaxyproject.org/patch/filter_security_15_07.patch For Galaxy releases 14.10 to 15.05: https://depot.galaxyproject.org/patch/filter_security_14_10.patch To apply the patch, navigate to the root of your Galaxy directory, then execute (replacing <patch_url> with the url above appropriate for your current Galaxy release): % wget -O filter_security.patch <patch_url> or: % curl -o filter_security.patch <patch_url> and then test applying the patch: % patch -p1 --dry-run < filter_security.patch checking file tools/filters/gff/gff_filter_by_attribute.py checking file tools/filters/gff/gff_filter_by_attribute.xml checking file tools/filters/gff/gff_filter_by_feature_count.py checking file tools/filters/gff/gff_filter_by_feature_count.xml If this succeeds without error (applying successfully with fuzz/offset is fine), apply with: % patch -p1 < filter_security.patch patching file tools/filters/gff/gff_filter_by_attribute.py patching file tools/filters/gff/gff_filter_by_attribute.xml patching file tools/filters/gff/gff_filter_by_feature_count.py patching file tools/filters/gff/gff_filter_by_feature_count.xml In all cases, for the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. On behalf of the Galaxy Committers, --nate

1 0

December Galaxy News: New web site, GAMe deadline extended
by Dave Clements 06 Dec '16

06 Dec '16

Hello all, The *December Galaxy News <https://new.galaxyproject.org/GalaxyUpdates/2016_12/>* is hot off the press, *and is was produced on a a hot new press. *Highlights this month include: - The *Galaxy Community Hub (the Hub) <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#galaxy-community-hub-t…>* will be the new home for Galaxy Community documentation, replacing the current wiki. - And we are asking for help to get it ready for it's official launch <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#the-community-hub-cont…> - *Galaxy Australasia Meeting (GAMe 2017) <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#galaxy-australasia-mee…>*: February 3-9, Melbourne, Victoria, Australia. - *Talk abstract submission extended to 14 December.* - *Early registration ends 31 December.* - And of course, other upcoming events <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#all-upcoming-events> too There are also 60 new publications (including eight featured pubs), four open positions, two new public Galaxy servers, new releases of Planemo & Pulsar, and other news too. Dave Clements and the Galaxy Team -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Talk abstracts for Galaxy Australasia Meeting (GAMe 2017) are due 30 Nov
by Dave Clements 23 Nov '16

23 Nov '16

Hello all, This is just a reminder that talk abstracts for the 2017 Galaxy Australasia Meeting (GAMe 2017, https://www.embl-abr.org.au/game2017/) are due Wednesday, 30 November. GAMe 2017 is a series of events in Melbourne, Australia running from 3 February through 11 February. This includes a training day for researchers on *using* Galaxy, a two day meeting, and then a 4 day course on how to set up your own production quality Galaxy server. Oral presentations will be given at the meeting, 4-5 February. The meeting is split into a BIO Day (4 Feb) focusing on biological applications, and an INFO Day (5 Feb) focusing on infrastructure, tools, development and deployment. Participants can register for one or both days, and you can specify a preferred presentation day when you submit your abstract(s). GAMe 2017 will also feature poster presentations, keynotes, birds-of-a-feather meetups, and lots of networking., Poster abstracts are reviewed on a rolling basis and will be accepted until we run out of poster space (so, submitting sooner is better). Early registration ends 31 December. We strongly encourage you to register early can save up to 45% off regular registration rates. We hope to see you in Melbourne! The GAMe 2017 Organising Committee -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

November 2016 Galactic News
by Dave Clements 31 Oct '16

31 Oct '16

1 0

News of the Galaxy: October 2016
by Dave Clements 03 Oct '16

03 Oct '16

1 0

New Galaxy Australia community opens registrations for GAMe 2017
by Dave Clements 03 Oct '16

03 Oct '16

>From the GAMe 2017 Organising Committee <https://www.embl-abr.org.au/game2017/organisers/>: Today we officially launch the Galaxy Australia <https://www.embl-abr.org.au/galaxyaustralia/> community with the opening of registrations for the Galaxy Australasia Meeting 2017 (GAMe 2017) being held in Melbourne over 3-9 February. Australian Galaxy users and administrators will now have more opportunities to interact and collaborate to identify and address the needs of the local community. The community will also be a hub for Australian Galaxy training courses and offer a catalog of Australian Galaxy servers. The establishment of Galaxy Australia is supported by the EMBL Australia Bioinformatics Resource (EMBL-ABR) in its appointed role of supporting the development of skills and training in the Australian life science research community. At the EMBL-ABR Hub, hosted at the Victorian Life Sciences Computation Initiative (VLSCI), Galaxy is used extensively for teaching and data analysis directly as well as through the Australian-made Genomics Virtual Laboratory <https://www.genome.edu.au/>. VLSCI’s expert bioinformaticians and professional staff will help promote community activities and training. Galaxy Australia has a Twitter feed (@GalaxyAustralia <https://twitter.com/galaxyaustralia>) for announcements and discussion relevant to the community. *Galaxy Australasia Meeting 2017 (GAMe 2017)* The Community’s first major activity is to organise the Galaxy Australasia Meeting 2017 (GAMe 2017), 3-9 February in Melbourne. We are pleased to announce that early registration <https://www.embl-abr.org.au/game2017/registration/> and talk and poster abstract submission <https://www.embl-abr.org.au/game2017/submit-your-talkposter/> are now open for the GAMe 2017. This meeting will bring together biomedical researchers, bioinformaticians, infrastructure providers, and data producers from across Australia and Asia to share expertise across many levels. The conference <https://www.embl-abr.org.au/game2017/conference/> starts 4 February and features two full days of keynotes, accepted and sponsor talks, poster and sponsor sessions, birds-of-a-feather gatherings, a conference dinner and lots of opportunities for networking. Prior to the conference we are offering a Researcher Training Day <https://www.embl-abr.org.au/game2017/training-day/> on 3 February, aimed at biomedical researchers who need to analyse their biological data. The conference is followed by a four day workshop on Galaxy server administration <https://www.embl-abr.org.au/game2017/training-for-admin-workshop/> for those working at that level. Talk abstracts are due 30 November <https://www.embl-abr.org.au/game2017/submit-your-talkposter/> and early registration ends 31 December <https://www.embl-abr.org.au/game2017/registration/>. Register now and save up to 43% off regular registration rates. There are also scholarships available for eligible students and postdocs <https://www.embl-abr.org.au/game2017/registration/#scholarships>. The scholarship application deadline is 18 November. We look forward to welcoming you to Melbourne. Remember to pack for our fabulous February weather! *GAMe 2017 Organising Committee <https://www.embl-abr.org.au/game2017/organisers/> (#game_2017)* -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

GCC2018: Call for Host Proposals
by Dave Clements 27 Sep '16

27 Sep '16

Hello all, The Galaxy Community Conference has been held annually since 2010. *GCC2017* <https://gcc2017.sciencesconf.org/> will be held 26-30 June in Montpellier, France. *We are now seeking proposals <https://wiki.galaxyproject.org/Documents?action=AttachFile&do=view&target=G…> from organizations interested in hosting GCC2018.* GCC alternates every year between meeting in North America, and meeting outside North America. Hosts for GCC2018 need to be located in North America. GCC draws 200+ participants from data-intensive life science research. Participants come from around the world, from all career stages, and do research spanning the tree of life. Universities, hospitals and medical schools, research organizations, and industry are all represented, including some of the largest and most influential research organizations in the world. What do you need to host GCC2018? In approximately decreasing order of importance: - *Enthusiasm to plan and organize several events over several days for more than 200 people. * - Space for 4-6 parallel training sessions, with each space able to accommodate 25 to 75 participants. - Central meeting space with capacity for 250-300 people. - Affordability (or access to sponsorship funds) - Nearby space for breakouts, poster sessions and sponsors. - Nearby space for lunch, coffee breaks. - Good wifi for all events (that's 200+ people and their devices). - Space for hackathons for 2 days - Easy to get to by air. - Nearby, affordable housing, or easy walking distance or easy public transport from lodging options to conference facilities - Close proximity to a pub and other social hubs. Hosts get copious (and enthusiastic) organizational support from Galaxy's Outreach Team (who have been helping to organize GCC since 2011), and even more copious gratitude from the Galaxy Community. You also get to highlight your institution to the Galaxy Community. See the *full call for host proposals <https://wiki.galaxyproject.org/Documents?action=AttachFile&do=view&target=G…>* for more details on what should be covered in proposals. *Proposals are due on November 30, 2016*. If you are interested in possibly hosting GCC2018 then please contact Dave Clements with any questions. Our goal is to announce GCC2018 at GCC2017 this coming June. Hoping to work with you in 2018! Dave Clements and the Galaxy Team -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Galaxy Admin Training: November 7-11, Salt Lake City
by Dave Clements 12 Sep '16

12 Sep '16

Hello all, *Early registration <https://wiki.galaxyproject.org/Events/AdminTraining2016/Registration> for Galaxy Admin Training 2016 <https://wiki.galaxyproject.org/Events/AdminTraining2016> ends in one week, on Monday, September 19.* Galaxy Admin Training 2016 <https://wiki.galaxyproject.org/Events/AdminTraining2016> is a weeklong event offering basic and advanced sessions. It will be held in Salt Lake City, Utah, November 7-11, 2016, the week before Supercomputing 16 (SC16) <http://sc16.supercomputing.org/> meets in Salt Lake. These workshops are aimed at admins from organizations and labs that are installing, upgrading, or prototyping Galaxy instances. *Basics Session: November 7-8* <https://wiki.galaxyproject.org/Events/AdminTraining2016/BasicsSession> This two day basics session <https://wiki.galaxyproject.org/Events/AdminTraining2016/BasicsSession> will introduce participants to what you need to know to get a Galaxy server up and running on a standalone server. You'll also learn how to extend your Galaxy with your own tools and tools from the community, and how to define reference data in your server. *Advanced Session: November 9-11* <https://wiki.galaxyproject.org/Events/AdminTraining2016/AdvancedSession> The three day advanced session <https://wiki.galaxyproject.org/Events/AdminTraining2016/AdvancedSession> will build on topics covered in the basics section <https://wiki.galaxyproject.org/Events/AdminTraining2016/BasicsSession>. This session both extends those topics, such as tool definition, and adds new ones, such as working with compute clusters and heterogeneous resources. The goal of the advanced workshop is to enable Galaxy administrators to create robust, high-performance Galaxy instances that take full advantage of available tools and compute and storage resources. Galaxy Admin Training 2016 is hosted by the University of Utah Center for High Performance Computing (CHPC) <http://www.chpc.utah.edu/>, the USTAR Center for Genetic Discovery (UCGD) <http://ucgd.genetics.utah.edu/>, Department of Biomedical Informatics <http://medicine.utah.edu/dbmi/> and the Clinical & Translational Science Biomedical Informatics Core (CCTS BMIC) <http://medicine.utah.edu/ccts/bmic/> at the University of Utah <http://utah.edu/>. We hope to see you in Salt Lake! The Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> PS: Please share this flier <https://wiki.galaxyproject.org/Events/AdminTraining2016/Publicity> with any individuals or groups who might be interested in this event. -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

September 2016 Galactic News
by Dave Clements 06 Sep '16

06 Sep '16

1 0