- galaxy-announce - lists.galaxyproject.org

Galaxy security vulnerabilities and 2015.01.13 Galaxy Stable Release
by Nate Coraor 13 Jan '15

13 Jan '15

A number of security vulnerabilities were recently discovered by Bartlomiej Balcerek and colleagues at the Wroclaw Centre for Networking and Supercomputing, which have been fixed in the current stable Galaxy release (2014.10.06). We have simultaneously created a new stable release (2015.01.13) today which includes these fixes as well as new features. Galaxy server administrators are STRONGLY encouraged to update their Galaxy servers to one of these releases immediately. The first vulnerability identified would allow a malicious person to execute arbitrary code on a Galaxy server. The vulnerability is due to gaps in Galaxy's command line template parameter sanitization. Although all form fields were sanitized for shell metacharacters, some other parameters that might be provided to tools on the command line (such as the input dataset name) were not. Because of this, dataset names and other fields could be constructed to exploit this vulnerability. Due to the severity of this specific vulnerability, the fix for it has been applied back to previous releases beginning with the January 13, 2013 release. The fix can be obtained by executing `hg pull && hg update latest_<YYYY>.<MM>.<DD>`, replacing the date with the date of the release currently in use. In addition to the code execution exploit, a number of cross-site scripting (XSS) vulnerabilities were identified by Bartlomiej which we have fixed in our new and previous stable releases. We only backport fixes for exploits that we believe allow an attacker to readily gain access to the Galaxy server to previous stable releases - nonetheless we consider these XSS vulnerabilities to be serious and would strongly recommend that public servers upgrade to at least the previous stable release, using the latest_2014.10.06 tag, to address them. The Galaxy Team also performed an audit to locate and fix any additional XSS vulnerabilities that might exist. Additional details on issues found and resolved can be found in the January 13, 2015 Galaxy Distribution News Brief at: https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13 To get the changes, for example, if you are running release_2014.10.06 (or a subsequent commit to the stable branch of Galaxy between release_2014.10.06 and release_2015.01.13), you can update with: % hg pull % hg update latest_2014.10.06 For the changes to take effect, YOU MUST RESTART ALL GALAXY SERVER PROCESSES. The Galaxy Team would like to extend special thanks to Bartlomiej Balcerek and colleagues, who privately disclosed the arbitrary code execution and XSS vulnerabilities, with a full report and proof of concepts. Credit for the arbitrary code execution fix goes to my fellow Galaxy Team member Daniel Blankenberg. The entire team worked to resolve the identified XSS issues and conduct the larger code audit. On behalf of the Galaxy Team, --nate

1 0

January 13, 2015 Galaxy Distribution
by Jennifer Hillman-Jackson 13 Jan '15

13 Jan '15

*January 13, 2015 Galaxy Distribution* <https://wiki.galaxyproject.org/News/2014_01_13_Galaxy_Distribution> [image: width=175] <http://getgalaxy.org/> *Complete News Brief <http://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13>* Security Several *critical* security vulnerabilities were recently discovered by Bartlomiej Balcerek and colleagues at the Wroclaw Centre for Networking and Supercomputing. This stable Galaxy release contains fixes for those vulnerabilities <https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13#Security>. *The Galaxy Team strongly encourages Galaxy server administrators to update their Galaxy servers immediately.* IPython Integration Thanks to the awesome work of community members Björn Grüning and Eric Rasche, Galaxy now features integration with the popular IPython project <https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13#IPython_Integration>. The Galaxy-IPython <https://github.com/bgruening/galaxy-ipython> project has been merged into Galaxy core and made into a generic plugin framework of interactive environments based on Docker. Tool Form Upgrade (for Beta Testing) In Galaxy's development branch, the basic tool from has been redesigned and modernized to address certain limitations in Galaxy's responsiveness when working with longer forms containing multiple parameter choices <https://wiki.galaxyproject.org/DevNewsBriefs/2015_01_13#Tool_Form_Upgrade_.…>. This new tool form will become the default with the next release - but we are hoping tool author's and power users enable it and provide feedback during this release cycle in order to ensure it is working ideally when it becomes the default. Get The Distribution [image: getgalaxy] <http://getgalaxy.org/> *getgalaxy.org <http://wiki.galaxyproject.org/Admin/GetGalaxy>* *galaxy-dist.readthedocs.org <http://galaxy-dist.readthedocs.org/>* *bitbucket.org/galaxy/galaxy-dist <http://bitbucket.org/galaxy/galaxy-dist>* *new*: $ hg clone https://bitbucket.org/galaxy/galaxy-dist#stable *upgrade*: $ hg pull $ hg update latest_2015.01.13 *Thanks for using Galaxy!* The Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- Jennifer Hillman-Jackson http://galaxyproject.org

1 0

GCC2015 Training Day Topic Nominations are Open through January 6
by Dave Clements 05 Jan '15

05 Jan '15

Hello all, GCC2015 Training Day <http://gcc2015.tsl.ac.uk/training-day/> topics are nominated by you <http://bit.ly/gcc2015tdnom>, the Galaxy Community. Please take a few minutes to nominate a topic. Any topic of interest to the Galaxy Community can be nominated and you are encouraged to nominate more than one. If you are looking for ideas, see the topics nominated in 2013 <http://bit.ly/1i2j1gN> and 2014 <http://bit.ly/1s6NtMN>, and the Events <https://wiki.galaxyproject.org/Events> and the Events Archives <https://wiki.galaxyproject.org/Events/Archive> pages. Nominated topics will be published on the Training Day <http://gcc2015.tsl.ac.uk/training-day/> page as they come in. *Nominations close 6 January*. Topics will be compiled into a uniform list by the GCC2015 Organising Committee <http://gcc2015.tsl.ac.uk/organisers>, and topics will be voted on by the Galaxy Community 12-23 January. Topics will then be selected and scheduled based on topic interest, and the organisers' ability to confirm instructors for each session. Some very popular sessions may be scheduled more than once. The final schedule will be posted before registration opens. Cheers, GCC2015 Organising Committee <http://gcc2015.tsl.ac.uk/organisers> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 1

January 2015 Galaxy News!
by Dave Clements 05 Jan '15

05 Jan '15

1 0

December 2014 Galaxy Newsletter
by Dave Clements 01 Dec '14

01 Dec '14

Hello all, As always there's a lot going on in the Galaxy this month. "Like what?" you say. Well, read the dang December Galaxy Newsletter <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12> we say! Highlights include: - Galaxy Day! In Paris! This Wednesday! <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#Galaxy_Day:_3_December…> - Near Richmond, Virginia? There's a Galaxy Workshop at Virginia State U on December 12 <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#Intro_to_Galaxy_Worksh…> . - GCC2015 needs sponsors <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#GCC2015:_6-8_July.2C_N…> ! - Other upcoming events <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#Other_Events> on two continents - *96 new papers <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#New_Papers>*, including 6 highlighted papers, referencing, using, extending, and implementing Galaxy. - Job openings at 7+ organizations <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#Who.27s_Hiring> - A new mailing list: Galaxy-Training <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#New_Galaxy-Training_Ma…> - 15 new ToolShed repositories from 10 contributors <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#ToolShed_Contributions> - And, 10 other juicy <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#Other_News> (well maybe not *juicy*, but certainly not *crunchy*) bits of news <https://wiki.galaxyproject.org/GalaxyUpdates/2014_12#Other_News> Happy December! Dave Clements and the *crisp* Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Galaxy Mailing Lists are moving
by Nate Coraor 11 Nov '14

11 Nov '14

Hello Galaxy Community, *Galaxy Mailing Lists are moving!* During the week of November 17-21, 2014, Galaxy mailing lists (including this one) will be migrated from lists.bx.psu.edu to lists.galaxyproject.org . This transition should be largely transparent to you, but there are a few things to be aware of: - List sender addresses and headers will change to reflect the updated domain: from bx.psu.edu to galaxyproject.org. Existing email filters you have set up may require adjustments. - Posts from lists.galaxyproject.org could be categorized as spam until you train your filtering method. - Mailing list archives and posting functionality will be briefly inaccessible during the migration. - The prior bx.psu.edu list posting email addresses will continue to accept email, which will be forwarded to the new list addresses. As always, you can manage your subscription for any Galaxy mailing list by following the link instructions at the bottom of this announcement. If you should notice any problems after the migration, please do not hesitate to let us know, via email to both "<list>-owner(a)lists.galaxyproject.org" (after the move) and to myself. Thanks, --nate, and the Galaxy Team

1 0

(no subject)
by Dave Clements 03 Nov '14

03 Nov '14

1 0

Galaxy Training Network
by Dave Clements 16 Oct '14

16 Oct '14

Hello all, We are pleased to announce the *Galaxy Training Network (GTN) <https://wiki.galaxyproject.org/Teach/GTN>*, a network of trainers who teach bioinformatics using Galaxy, or teach about Galaxy itself. The GTN aims to make it easy to find Galaxy trainers <https://wiki.galaxyproject.org/Teach/Trainers>, and to share and discover the wealth of training resources available for Galaxy. This includes training materials <https://wiki.galaxyproject.org/Teach/Resources>, a trainer directory <https://wiki.galaxyproject.org/Teach/Trainers>,best practices <https://wiki.galaxyproject.org/Teach/BestPractices>, and guidance on computing platforms <https://wiki.galaxyproject.org/Teach/ComputingPlatforms> for teaching with Galaxy. The Galaxy Training Network is accessible to the entire community. If you teach with Galaxy, then please consider adding your organization <https://wiki.galaxyproject.org/Teach/Trainers#Add_a_Trainer>, materials <https://wiki.galaxyproject.org/Teach/Resources#Add_a_Training_Resource>, and best practices <https://wiki.galaxyproject.org/Teach/BestPractices>. The Trainer Directory <https://wiki.galaxyproject.org/Teach/Trainers> already includes 16 organizations and there may be one (or 6!) near you <http://bit.ly/gxytrnmap>. Thanks, The Galaxy Training Network (GTN) <https://wiki.galaxyproject.org/Teach/Trainers> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

October 2014 Galaxy Newsletter
by Dave Clements 01 Oct '14

01 Oct '14

Hello all, A lot is happening in in the Galaxy in October, and a lot of good stuff happened in September too. Take a look at the October 2014 Galaxy Newsletter <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10> for the complete story, but here are some highlights: - *Galaxy needs your input! <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#Galaxy_Needs_Your_Inpu…>* You may even get rewarded for your input ... - IRC channel to be logged <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#IRC_Channel_Policy_Cha…>, starting this month - Slides from ECCB'14 and upcoming events <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#Events> - 71 new papers <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#New_Papers>, including 6 featured papers - Who's Hiring? <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#Who.27s_Hiring> Lots of places, that's who - Two new public Galaxy Servers <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#New_Public_Servers> - New Deployment Catalog and Log Board entries <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#Community_Galaxy_Hubs> - 36 new ToolShed repos <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#ToolShed_Contribution> - And a smattering of other news <https://wiki.galaxyproject.org/GalaxyUpdates/2014_10#Other_News> too Happy October! Dave Clements and the Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

2014 Galaxy Questionnaire
by Dave Clements 30 Sep '14

30 Sep '14

Hello all, The Galaxy Project is preparing for our next grant cycle and we are seeking your feedback and comments on on all things Galaxy. We have created two questionnaires, each focused on a different way to interact with Galaxy: 1. *Galaxy User Questionnaire <https://docs.google.com/forms/d/1NT3ma2g7rR-mWA_vgOg2Ia_6VTFiZ86um2JhX2SecC…>* 2. *Galaxy Admin, Tool Developer, and Galaxy Developer Questionnaire <https://docs.google.com/forms/d/1lszXJ2lDJ2dYCWKXBk1qT1jO7XdDDfxXmGRCUMZFX2…>* Please take a few minutes and fill out the surveys that apply to you. The questionnaires are structured so you can skip topics (whole pages!) that don't apply to you, and every question is optional. *And, to thank you for your time and effort, the Galaxy Project will increase your storage quota on usegalaxy.org <https://usegalaxy.org/> by 50GB. *That's a 20% increase. Let your voice be heard (and, get some storage)! The Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0