From 5d6249ec6fb45db681ad727c63612d20cb40a013 Mon Sep 17 00:00:00 2001 From: Martin Cech Date: Tue, 15 May 2018 22:10:30 -0500 Subject: [PATCH] add security and breaking changes to release notes --- doc/source/releases/18.05_announce.rst | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/doc/source/releases/18.05_announce.rst b/doc/source/releases/18.05_announce.rst index 26a411ddb63..25025c5b9a4 100644 --- a/doc/source/releases/18.05_announce.rst +++ b/doc/source/releases/18.05_announce.rst @@ -70,8 +70,25 @@ To update an existing Galaxy repository run: See the `community hub `__ for additional details regarding the source code locations. +Security +======== + +vcffilter by devteam allowed RCE +-------------------------------- +Tracked as ``GX-2018-0004``. + +Older versions of the VCF filter tool in the `vcffilter repository by devteam `__ allowed remote code execution due to missing character escaping. +If you have this repository installed in your Galaxy please update to the revision ``4:6b935ab36d7b`` or newer and disable/uninstall all older versions. + +Breaking Changes +================ + +The ``charts`` repository that powers Galaxy built-in visualizations that need backend computation has been moved +to the IUC account. In order for these visualization options to keep working admins need to install the following repository: `iuc/charts `__. + + Release Notes -=========================================================== +============= .. include:: 18.05.rst :start-after: announce_start