1.8

1.8.22 Released

Submitted by LedgerSMB_Team on Tue, 10/12/2021 - 13:36

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application.
This release contains the following fixes and improvements:

Changelog for 1.8.22

* Fix sending mail with multiple Bcc addresses (#6087)
* Fix manual taxes on credit invoices (#5721)
* Fix 'Secure' flag on session cookie; CVE-2021-3882
* Improve configuring acceptable reverse proxy addresses

Security advisory for CVE-2021-3882 (non-Secure session cookie)

Submitted by ehu on Tue, 10/12/2021 - 11:41

  Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Summary

  LedgerSMB does not set the 'Secure' attribute on the session authorization
  cookie when the client uses HTTPS and the LedgerSMB server is behind a
  reverse proxy.  By tricking a user to use an unencrypted connection (HTTP),
  an attacker may be able to obtain the authentication data by capturing
  network traffic.


Known vulnerable

  All of:

  - 1.8.0 upto 1.8.21 (including)


Known fixed

  - 1.8.22

1.8.21 Released

Submitted by LedgerSMB_Team on Sat, 09/18/2021 - 14:12

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application.
This release contains the following fixes and improvements:

Changelog for 1.8.21

* Prevent draft approval by user without permission (#5984)
* Fix UI consistency (missing CSS class) in purchase invoice (#5988)
* Fix performance problem deleting huge draft transactions (#5993)

1.8.20 Released

Submitted by LedgerSMB_Team on Fri, 09/03/2021 - 11:32

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application.
This release contains the following fixes and improvements:

Changelog for 1.8.20

* Fix for chart of accounts headings import from CSV (#5987)
* Correctly set the payment account in invoices and transactions (#5801)
* Fix regression in CVE-2021-3693 failing to show errors as popups (#5921)
* Fix regression in CVE-2021-3693 with broken downloads of backups (#5931)

1.8.19 Released

Submitted by ehu on Wed, 08/25/2021 - 14:38

Unfortunately, the fixes for the security vulnerabilities
released on Monday August 23 regressed some functionalities.
This release fixes those regressions:

Changelog for 1.8.19

* Follow-up for the fix to CVE-2021-3693; fix bulk-posting payments
* Follow-up for the fix to CVE-2021-3693; fix incorrectly backported change

For installation instructions and system requirements, see
https://github.com/ledgersmb/LedgerSMB/blob/1.8.19/README.md

1.8.18 Released

Submitted by ehu on Mon, 08/23/2021 - 14:26

The LedgerSMB development team is happy to announce yet another new
version of its open source ERP and accounting application. This
release contains three fixes for security vulnerabilities. Users are
urged to upgrade as soon as possible. Special thanks go to "ranjit-git",
and sudheendra17, users of the https://huntr.dev/ platform, for disclosing
these issues responsibly to the development team. And to the platform
itself for sponsoring the work of these researchers.

Upgrading LedgerSMB 1.8.x to 1.8.y

Submitted by ehu on Sun, 08/22/2021 - 03:10

There are two steps to upgrading a LedgerSMB 1.8.x installation to 1.8.y (x smaller than y):

  1. Upgrade the software
  2. Upgrade the company database

The second step has to be executed for each company database that's set up.

Upgrade the software

The steps to upgrade the software differ between Docker or tarball (from source) installations.

Upgrading Docker installations

In case the installation was created using the docker-compose infrastructure provided by the project, the upgrade should be as simple as running

Security advisory for CVE-2021-3693 (Cross site scripting)

Submitted by ehu on Fri, 08/20/2021 - 03:14

DOM cross-site scripting of authenticated users in LedgerSMB

Summary

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM.  By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.


Known vulnerable

  All of:

  - 1.5.0 upto 1.5.30 (including)
  - 1.6.0 upto 1.6.33 (including)
  - 1.7.0 upto 1.7.32 (including)
  - 1.8.0 upto 1.8.17 (including)


Known fixed

  - 1.7.33
  - 1.8.18

Security advisory for CVE-2021-3694 (Cross site scripting)

Submitted by ehu on Fri, 08/20/2021 - 03:13

Reflected cross-site scripting of authenticated users in LedgerSMB

Summary

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser.  By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

Known vulnerable

  All of: