- galaxy-announce - lists.galaxyproject.org

Security vulnerability in Galaxy filtering tools
by Nate Coraor 04 Nov '13

04 Nov '13

A security vulnerability was recently discovered by John Chilton with Galaxy's "Filter data on any column using simple expressions" and "Filter on ambiguities in polymorphism datasets" tools that can allow for arbitrary execution of code on the command line. The fix for these tools has been committed to the Galaxy source. The timing of this commit coincides with the next Galaxy stable release (which has also been pushed out today). To apply the fix and simultaneously update to the new Galaxy stable release, ensure you are on the stable branch and upgrade to the latest changeset: % hg branch stable % hg pull -u For Galaxy installations that administrators are not yet ready to upgrade to the latest release, there are three workarounds. First, for Galaxy installations running on a relatively new version of the stable release (e.g. release_2013.08.12), Galaxy can be updated to the specific changeset that that contains the fix. This will include all of the stable (non-feature) commits that have been accumulated since the 8/12 release plus any new features included with (and prior to) the 8/12 release, but without all of the new features included in the 11/4 release. Ensure you are on the stable branch and then upgrade to the specific changeset: % hg pull -u -r e094c73fed4d Second, the patch can be downloaded and applied manually: % wget -o security.patch https://bitbucket.org/galaxy/galaxy-central/commits/e094c73fed4dc66b589932e… and then: % hg patch security.patch or: % patch -p1 < security.patch Third, the tools can be completely disabled by removing them from the tool configuration file (by default, tool_conf.xml) and restarting all Galaxy server processes. The relevant lines in tool_conf.xml are: <tool file="stats/dna_filtering.xml" /> <tool file="stats/filtering.xml" /> The full 11/4 Galaxy Distribution News Brief will be available later today and will contain details of changes since the last release. --nate Galaxy Team

1 0

November 2013 Galaxy Update Newsletter
by Dave Clements 31 Oct '13

31 Oct '13

Hello all, The November 2013 Galaxy Update is out<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11> : *Highlights:* - Two new public Galaxy servers<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#New_Public_Servers> : CoSSci: Complex Social Science Gateway<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#CoSSci:_Complex_Social_…> (which has *nothing* to do with biology), and BioCiphers Lab Galaxy<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#BioCiphers_Lab_Galaxy> . - 53 new papers<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#New_Papers>, including "Expanding roles in a library-based bioinformatics service program: a case study," "DDBJ Read Annotation Pipeline: A Cloud Computing-Based Pipeline for High-Throughput Analysis of Next-Generation Sequencing Data," and "Ten Simple Rules for Reproducible Computational Research" - Who's hiring<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#Who.27s_Hiring> - Upcoming Events<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#Other_Events>, including - Save these dates! GCC2014: June 30 - July 2, Baltimore<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#GCC2014:_June_30_-_July…> - Galaxy Day, December 4, Paris<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#Galaxy_Day.2C_December_…> - UC Davis Bioinformatics Boot Camps<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#UC_Davis_Bioinformatics…> - Lifeportal launched at the University of Oslo<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#Lifeportal_at_the_Unive…> - Tool Shed contributions<http://wiki.galaxyproject.org/GalaxyUpdates/2013_11#Tool_Shed_Contributions> If you have anything you would like to see in the next *Galaxy Update<http://wiki.galaxyproject.org/GalaxyUpdates> *, please let us know. Dave Clements and the Galaxy Team <http://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ http://wiki.galaxyproject.org/

1 0

Please save these dates! GCC2014: June 30 - July 2
by Dave Clements 02 Oct '13

02 Oct '13

Hello all, The 2014 Galaxy Community Conference (GCC2014)<http://wiki.galaxyproject.org/Events/GCC2014> has been scheduled for June 30 through July 2, at the Homewood Campus<http://webapps.jhu.edu/jhuniverse/information_about_hopkins/campuses/homewo…> of Johns Hopkins University <http://jhu.edu/>, in Baltimore, Maryland<http://visitors.baltimorecity.gov/>, United States. Galaxy Community Conferences are an opportunity to participate in presentations, discussions, poster sessions, lightning talks and breakouts, all about high-throughput biology and the tools that support it. The conference will also includes a*Training Day* offering in-depth topic coverage, across several concurrent sessions. See the GCC2013 web site<http://wiki.galaxyproject.org/Events/GCC2013> for an idea of what happens at a Galaxy Community Conference. See you next summer, GCC2014 Organizing Committee<http://wiki.galaxyproject.org/Events/GCC2014/Organizers> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ http://wiki.galaxyproject.org/

1 0

October Galaxy Update Newsletter is out
by Dave Clements 30 Sep '13

30 Sep '13

Hello all, The October 2013 Galaxy Update is out<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10> : *Highlights:* - A record *six new public servers<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#New_Public_Servers> * - 44 new papers<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#New_Papers> - Open Positions<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#Who.27s_Hiring> at nine different organizations - Upcoming Events<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#Events>, lots of them in Australia<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#Australia.21> plus 3 other continents<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#All_Those_Other_Contine…>. - Online materials from past events<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#Online_Materials_from_P…>, including all GCC2013 videos on Vimeo <http://bit.ly/gcc2013vimeo> and course materials for the 2013 UC Davis Bioinformatics Short Course<http://bit.ly/16rAUkf>. The UC Davis course featured 5 great days of lecture and hands-on exercises. - More Tool Shed contributions<http://wiki.galaxyproject.org/GalaxyUpdates/2013_10#Tool_Shed_Contributions> than you can shake a stick at. If you have anything you would like to see in the next *Galaxy Update<http://wiki.galaxyproject.org/GalaxyUpdates> *, please let us know. Dave Clements and the Galaxy Team <http://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ http://wiki.galaxyproject.org/

1 0

August 2013 Galaxy Update Newsletter is out
by Dave Clements 30 Aug '13

30 Aug '13

1 0

Galaxy Distribution Aug 12, 2013
by Jennifer Jackson 12 Aug '13

12 Aug '13

*Galaxy Distribution **Aug 12, 2013* / / /////http://bit.ly/galaxy20130812/ *Highlights:* * Upgrades to *Data Manager* including improved installation actions * *Visualization* Framework tunings, plus updates to *Phyloviz*, *Scatterplot*, and *Trackster *** * *Workflows* include new reproducibility controls and editing features * Multiple *Tool Shed* enhancements, features, and tunings * Plus additional updates to the *UI*, *Admin* and *Core*, and *API*, an important *Security Fix* reminder, and *Bug Fixes* http://getgalaxy.org http://bitbucket.org/galaxy/galaxy-dist http://galaxy-dist.readthedocs.org new: $ hg clone https://bitbucket.org/galaxy/galaxy-dist#stable upgrade: $ hg pull $ hg update release_2013.08.12 /Thanks for using Galaxy,/ The Galaxy Team -- Jennifer Hillman-Jackson http://galaxyproject.org

1 0

2014 Galaxy Training Survey
by Dave Clements 05 Aug '13

05 Aug '13

Hello all, The Galaxy Project is asking for your help on how we should focus our training efforts for the coming year. If you are interested in Galaxy Training, please take a few minutes to let us know what you would like to see offered, and where you would like training to be held: http://bit.ly/gxy14training Thanks in advance for your time and input, Dave C -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ http://wiki.galaxyproject.org/

1 0

August 2013 Galaxy Update Newsletter is out
by Dave Clements 31 Jul '13

31 Jul '13

1 0

(no subject)
by Dave Clements 29 Jun '13

29 Jun '13

1 0

Galaxy Security Notification
by Nate Coraor 12 Jun '13

12 Jun '13

A security vulnerability was recently discovered by Björn Grüning with Galaxy's "user impersonation" feature that can expose an administrator's active history to users whom they impersonate. Only Galaxy instances with `allow_user_impersonation = True` set in their configurations are affected, and only if an administrator makes use of the impersonation feature. By default, user impersonation is disabled. A fix (id: 9d42f1e32efb) has been provided in the stable branch of Galaxy. To apply the fix, ensure you are on the stable branch and upgrade to the latest changeset: % hg branch stable % hg pull -u For Galaxy installations on relatively old versions that administrators are not yet ready to upgrade, there are three workarounds. First, the patch can be downloaded and applied manually: % wget -o security.patch https://bitbucket.org/galaxy/galaxy-central/commits/9d42f1e32efb654fda1e011… and then: % hg patch security.patch or: % patch -p1 < security.patch Second, the impersonation feature can be disabled by setting the following option in Galaxy's configuration file: allow_user_impersonation = False In all of the above cases, the Galaxy server process(es) must be restarted for the change to take effect. Third, the feature can be left enabled and unpatched, and the vulnerability can be worked around by educating administrators who use the feature. As long as a new history is created by the administrator prior to switching to the impersonated user, no data will be exposed to the impersonated user. --nate Galaxy Team

1 0