- galaxy-announce - lists.galaxyproject.org

Galaxy Tool Shed Security Vulnerability - Repository uploads
by Nate Coraor 13 Aug '15

13 Aug '15

*DESCRIPTION* A security vulnerability was recently discovered by Peter Cock at the James Hutton Institute that would allow a malicious actor to upload new versions to repositories on which they have not been granted access. *AFFECTED VERSIONS* This issue affects versions of the Tool Shed beginning with 15.01. Earlier versions are not affected. *IMPACT* Because the Tool Shed is used to install software in Galaxy, if exploited, the impact could result in arbitrary code execution on Galaxy servers if a malicious tool is uploaded to a previously trusted repository, and that compromised version is subsequently installed by a Galaxy administrator. As such, Tool Shed administrators are strongly encouraged to update immediately. *INSTRUCTIONS* To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 15.07 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, YOU MUST RESTART ALL TOOL SHED SERVER PROCESSES. On behalf of the Galaxy Committers, --nate

1 0

Galaxy Security Vulnerability - Reflected XSS
by Nate Coraor 13 Aug '15

13 Aug '15

*DESCRIPTION* A security vulnerability was recently discovered by Scott B. Szakonyi at The Center for Research Computing at the University of Notre Dame that would allow a malicious actor to exploit the workflow import form to cause a user's browser to execute javascript not originating from within Galaxy. This could allow the malicious actor to gain unauthorized access to Galaxy accounts or client data. *AFFECTED VERSIONS* This issue affects all known versions of Galaxy. In early 2015, the Galaxy Team performed a large XSS audit, the results of which were applied to versions 14.10 and later. Using Galaxy versions earlier than 14.10 is not advisable. *IMPACT* Exploitation of reflected XSS vulnerabilities typically requires some coordination, but the consequences of exploitation can result in data or account exposure, so the risk of leaving the issue unfixed is moderate. Administrators of affected servers are encouraged to update immediately. *INSTRUCTIONS* To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 15.07 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, YOU MUST RESTART ALL GALAXY SERVER PROCESSES. On behalf of the Galaxy Committers, --nate

1 0

Galaxy Security Vulnerability - Authentication framework with LDAP
by Nate Coraor 13 Aug '15

13 Aug '15

*DESCRIPTION* A security vulnerability was recently discovered by Nicola Soranzo at The Genome Analysis Centre that would allow unauthorized access to Galaxy accounts on Galaxy servers using the LDAP authentication framework plugin. This is due to the fact that LDAP may be configured to allow anonymous binds, and the LDAP plugin does not check that binding with the provided username/password was not anonymous. *AFFECTED VERSIONS* The authentication framework is a new feature as of the 15.05 Galaxy release, so earlier versions are not affected. In versions 15.05 and later, the LDAP plugin is not used by default, so only Galaxy servers which have been configured to use this new functionality are affected. Galaxy servers using upstream delegated authentication (where authentication is performed by the proxy server, e.g. Apache or nginx) are not affected. *IMPACT* Administrators of affected servers are STRONGLY encouraged to update immediately, as the vulnerability allows unauthorized access to Galaxy accounts. *INSTRUCTIONS* To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 15.07 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, YOU MUST RESTART ALL GALAXY SERVER PROCESSES. On behalf of the Galaxy Committers, --nate

1 0

August 2015 Galactic News
by Dave Clements 31 Jul '15

31 Jul '15

1 0

June 2015 Galaxy New
by Dave Clements 01 Jun '15

01 Jun '15

1 0

May 2015 Galaxy Release (v 15.05)
by Jennifer Hillman-Jackson 15 May '15

15 May '15

*The May 2015 Galaxy Release is out!* Release Notes v 15.05 <http://galaxy.readthedocs.org/en/master/releases/15.05_announce.html> Release Highlights - *Authentication Plugins* - Galaxy now has native support for LDAP and Active Directory via a new community developed authentication plugin system. - *Tool Sections* - Tool parameters may now be groupped into collapsable sections. - *Collection Creators* - New widgets have been added that allow much more flexibility when creating simple dataset pair and list collections. - And *much more <http://galaxy.readthedocs.org/en/master/releases/15.05_announce.html>* The release notes have a new home at Read the Docs <http://galaxy.readthedocs.org/en/master/releases/15.05_announce.html>. We hope that you like the new format as much as we do! *Thanks for using Galaxy! * The Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- Registration for the 2015 Galaxy Community Conference is OPEN! http://gcc2015.tsl.ac.uk *Love* *Galaxy*? We are inviting Galaxy power end-users as well as scientists and bioinformatics support researchers to *join us for the inaugural* *Galaxy Data Wrangling Hackathon* preceding the 2015 Galaxy Community Conference conference this July. http://gcc2015.tsl.ac.uk/data-hackathon

1 0

GCC2015: Early Reg closes 22 May; Call for Birds-of-a-feather; and more
by Dave Clements 14 May '15

14 May '15

Hello all, A couple of GCC2015 related items: *Early Registration closes 22 May* Just a reminder that early registration <http://gcc2015.tsl.ac.uk/registration/> for the 2015 Galaxy Community Conference (GCC2015, http://gcc2015.tsl.ac.uk/) closes Friday, 22 May. Registering after that costs an average of 40% more. Space is limited at several events, and when that space is gone, it's gone for good. Register now <http://gcc2015.tsl.ac.uk/registration/> and attend the events you want to, and save 40%. GCC2015 includes several new events and features even more training than before. *Call for Birds of a Feather (BoFs) Meetups* *Birds of a feather* meetups are informal gatherings of GCC attendees with a shared interest. They are an essential part of GCCs. If you have an idea then for a BoF then you are strongly encouraged to propose one: https://wiki.galaxyproject.org/Events/GCC2015/BoFs *Oral Presentation Abstracts are Online* *Most* of the abstracts for accepted talks at GCC2015 are now online. We expect to put a few more up in the coming week. http://gcc2015.tsl.ac.uk/abstracts/ They aren't (yet) listed in any particular order. Again, please do remember to register by 22 May, and we hope to see you in Norwich! Cheers, Dave C -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

May 2015 Galactic News (and 2 GCC2015 deadlines today)
by Dave Clements 01 May '15

01 May '15

1 0

GCC2015 Registration is Open!
by Dave Clements 27 Apr '15

27 Apr '15

Hello all, We are tremendously pleased (and more than a little relieved) to announce that *registration for GCC2015 is now open <http://gcc2015.tsl.ac.uk/registration/>*. The 2015 Galaxy Community Conference <http://gcc2015.tsl.ac.uk/> includes 2 days of hackathons, 2 days of training, and a two day meeting <http://gcc2015.tsl.ac.uk/programme/> featuring accepted presentations, keynotes, poster sessions, lightning talks, birds-of-a-feather meetups, and plenty of networking. GCC2015 is hosted by The Sainsbury Laboratory <http://www.tsl.ac.uk/>, in Norwich, UK, and events run 4-8 July. Registration costs <http://gcc2015.tsl.ac.uk/registration/> depend on which events you register for <http://gcc2015.tsl.ac.uk/programme/>, your career stage/affiliation <http://gcc2015.tsl.ac.uk/registration/>, and when you register <http://gcc2015.tsl.ac.uk/registration/>*(register by 22 May - really, it will save you plenty).* Early bird registration starts at less than £40 / day for students and postdocs, and at £55 / day for other attendees from non-profits. You can also sign up for conference housing <http://gcc2015.tsl.ac.uk/logistics/#Lodging> during (and only during) registration. We apologize profusely for the delay in opening registration, and we thank you for your patience and faith. We promise the conference will againbe spectacular <https://wiki.galaxyproject.org/GalaxyProject/Statistics#Events> . Dave Clements <https://wiki.galaxyproject.org/DaveClements> and Martin Page <http://www.tsl.ac.uk/staff/martin-page/>, on behalf of the GCC2015 Organising Committee <http://gcc2015.tsl.ac.uk/organisers/>. PS: *And don't forget the poster abstract <http://gcc2015.tsl.ac.uk/Abstracts> submission deadline is 1 May.* -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Galaxy Tool Shed security vulnerability
by Nate Coraor 23 Apr '15

23 Apr '15

*Please note: This notice affects Galaxy Tool Shed servers only. Galaxy servers are unaffected.* A security vulnerability was recently discovered by Daniel Blankenberg of the Galaxy Team that would allow a malicious person to execute arbitrary code on a Galaxy Tool Shed server. The vulnerability is due to reuse of tool loading code from Galaxy, which executes "code files" defined by Galaxy tool config files. Because the Tool Shed allows any user to create and "load" tools, any user could cause arbitrary code to be executed by the Tool Shed server. In Galaxy, administrators control which tools are loaded, which is why this vulnerability does not affect Galaxy itself. Although we recommend upgrading to the latest stable version (15.03.2), a fix for this issue has been committed to Galaxy versions from 14.08 and newer. If you are using Mercurial, you can update with (where YY.MM corresponds to the Galaxy release you are currently running): % hg pull % hg update release_YY.MM If you are using git, you can update with (assuming your remote upstream is set to https://github.com/galaxyproject/galaxy/) If you have not yet set up a remote tracking branch for the release you are using: % git fetch upstream % git checkout -b release_YY.MM upstream/release_YY.MM Otherwise: % git pull upstream release_YY.MM For the changes to take effect, *you must restart all Tool Shed server processes*. Credit for the arbitrary code execution fix also goes to my fellow Galaxy Team member Daniel Blankenberg. On behalf of the Galaxy Team, --nate

1 0