|
|
|
@@ -3,8 +3,149 @@
|
|
|
|
|
September 2017 Galaxy Release (v 17.09)
|
|
|
|
|
===========================================================
|
|
|
|
|
|
|
|
|
|
.. include:: _header.rst
|
|
|
|
|
|
|
|
|
|
Schedule
|
|
|
|
|
Highlights
|
|
|
|
|
===========================================================
|
|
|
|
|
* Planned Freeze Date: 2017-09-04
|
|
|
|
|
* Planned Release Date: 2017-09-25
|
|
|
|
|
|
|
|
|
|
**Singularity**
|
|
|
|
|
Tool execution using the HPC-friendly container technology `Singularity <http://singularity.lbl.gov/>`__
|
|
|
|
|
is now supported. Custom containers can be specified by the Galaxy admin on a per job destination basis
|
|
|
|
|
or standardized containers corresponding to Conda requirements can be built or downloaded automatically
|
|
|
|
|
using the mulled toolkit built into Galaxy (just like is possible for Docker). For more information
|
|
|
|
|
checkout `this presentation <http://bit.ly/gcc-biocontainers>`__ from the 2017 Galaxy Community Conference.
|
|
|
|
|
`Pull Request 4175`_
|
|
|
|
|
|
|
|
|
|
**Download entire collection**
|
|
|
|
|
Downloading whole colections is now possible from the history interface. `Pull Request 4098`_
|
|
|
|
|
Thanks to `@mvdbeek <https://github.com/mvdbeek>`__.
|
|
|
|
|
|
|
|
|
|
**Switch tool versions in workflows**
|
|
|
|
|
You can now select exactly what version of tool you want to use when building workflows. `Pull Request 4373`_
|
|
|
|
|
Thanks to `@mvdbeek <https://github.com/mvdbeek>`__.
|
|
|
|
|
|
|
|
|
|
Get Galaxy
|
|
|
|
|
==========
|
|
|
|
|
|
|
|
|
|
The code lives at `Github <https://github.com/galaxyproject/galaxy>`__ and you should have `Git <https://git-scm.com/>`__ to obtain it.
|
|
|
|
|
|
|
|
|
|
To get a new Galaxy repository run:
|
|
|
|
|
.. code-block:: shell
|
|
|
|
|
|
|
|
|
|
$ git clone -b release_17.09 https://github.com/galaxyproject/galaxy.git
|
|
|
|
|
|
|
|
|
|
To update an existing Galaxy repository run:
|
|
|
|
|
.. code-block:: shell
|
|
|
|
|
|
|
|
|
|
$ git checkout release_17.09 && git pull --ff-only origin release_17.09
|
|
|
|
|
|
|
|
|
|
See `the community hub <https://galaxyproject.org/develop/source-code/>`__ for additional details regarding the source code locations.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Security
|
|
|
|
|
========
|
|
|
|
|
|
|
|
|
|
The 17.09 Galaxy version includes many security patches. Per our new `Security Policy
|
|
|
|
|
<https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md>`__ some of these have been
|
|
|
|
|
applied to Galaxy releases going back 12 months.
|
|
|
|
|
|
|
|
|
|
Details of the vulnerabilities that have been backported can be found in the `Security patch details`_
|
|
|
|
|
section of these release notes. Some issues have only been addressed in 17.09, for this reason
|
|
|
|
|
if security is important to your Galaxy instance we strongly recommend upgrading to this latest release
|
|
|
|
|
as soon as possible.
|
|
|
|
|
|
|
|
|
|
If you maintain a publicly accessible Galaxy please consider signing up for this `mailing list <https://lists.galaxyproject.org/listinfo/galaxy-public-servers>`__ to receive the future security patches in advance of the public disclosure.
|
|
|
|
|
|
|
|
|
|
Deprecation Notices
|
|
|
|
|
===================
|
|
|
|
|
|
|
|
|
|
* The Galaxy Sample Tracking and External Services functionality is now considered deprecated. In future releases we will strip down the related
|
|
|
|
|
user interface and introduce configuration option to keep relevant API controllers active if desired. `Related PR <https://github.com/galaxyproject/galaxy/pull/4526>`__.
|
|
|
|
|
* The deprecated admin-only interface for Galaxy Data Libraries is staged to be removed in the next release.
|
|
|
|
|
* Workflows API: When exposing WorkflowInvocationSteps ``state`` will no longer be available.
|
|
|
|
|
* The ``refresh_on_change`` attribute of a ``<param>`` tag in the tool syntax can no longer be set to a value of another parameter. Use boolean instead (e.g.``refresh_on_change="True"``). `Details <https://github.com/galaxyproject/galaxy/issues/4810>`__
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Release Notes
|
|
|
|
|
===========================================================
|
|
|
|
|
|
|
|
|
|
.. include:: 17.09.rst
|
|
|
|
|
:start-after: announce_start
|
|
|
|
|
|
|
|
|
|
Security patch details
|
|
|
|
|
======================
|
|
|
|
|
|
|
|
|
|
Limited Galaxy Data Library unauthorized filesystem access
|
|
|
|
|
----------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
Tracked as `GX-2017-0001 <https://lists.galaxyproject.org/pipermail/galaxy-dev/2017-October/026058.html>`__
|
|
|
|
|
|
|
|
|
|
A medium severity security vulnerability in Galaxy Data Libraries was
|
|
|
|
|
recently discovered by `Jelle Scholtalbers <https://github.com/scholtalbers>`__.
|
|
|
|
|
This vulnerability allows the following unauthorized actions:
|
|
|
|
|
|
|
|
|
|
1. Any user that has been granted the permission to add datasets to a
|
|
|
|
|
library, library folder, or to modify an existing library dataset (an
|
|
|
|
|
"authorized user"), is able to import any file on the system that is
|
|
|
|
|
readable by the user running the Galaxy server.
|
|
|
|
|
|
|
|
|
|
2. Anyone can create libraries and library folders (but not add datasets to them)
|
|
|
|
|
|
|
|
|
|
The fix for this issue has been applied to Galaxy releases back to 16.07 and can be found in this `commit <https://github.com/galaxyproject/galaxy/commit/93a8bfc7cb5e9c3395c5057910ec39d68ad787b4>`__
|
|
|
|
|
|
|
|
|
|
Arbitrary code execution for Galaxy servers with Galaxy Interactive Environments enabled
|
|
|
|
|
----------------------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
Tracked as `GX-2017-0002 <https://lists.galaxyproject.org/pipermail/galaxy-dev/2017-October/026059.html>`__
|
|
|
|
|
|
|
|
|
|
A high severity security vulnerability was recently discovered in Galaxy
|
|
|
|
|
Interactive Environments (GIEs) by the Galaxy Committers Team. Anyone with
|
|
|
|
|
a Galaxy account can exploit this vulnerability to execute arbitrary code
|
|
|
|
|
on the Galaxy server as the user running the Galaxy server process.
|
|
|
|
|
|
|
|
|
|
The vulnerability only affects Galaxy servers on which Galaxy Interactive
|
|
|
|
|
Environments are enabled (by setting the
|
|
|
|
|
`interactive_environment_plugins_directory`
|
|
|
|
|
option in `galaxy.ini`). Because the vulnerability can be exploited to
|
|
|
|
|
execute arbitrary code, the impact for affected servers is severe.
|
|
|
|
|
|
|
|
|
|
Administrators of Galaxy servers where GIEs *are* enabled should update
|
|
|
|
|
immediately.
|
|
|
|
|
|
|
|
|
|
The fix for this issue has been applied to Galaxy releases back to 17.05 and can be found in this `commit <https://github.com/galaxyproject/galaxy/commit/9f8d3ee444ad10038add204ed1c1dc11e636dd9d>`__
|
|
|
|
|
|
|
|
|
|
Unauthorized filesystem access via data source tools
|
|
|
|
|
----------------------------------------------------
|
|
|
|
|
|
|
|
|
|
Tracked as `GX-2017-0003 <https://lists.galaxyproject.org/pipermail/galaxy-dev/2017-October/026060.html>`__
|
|
|
|
|
|
|
|
|
|
A medium severity security vulnerability in tools utilizing the Galaxy data
|
|
|
|
|
source protocol was recently discovered by the Galaxy Committers Team.
|
|
|
|
|
Anyone who is able to run an external data source tool can access
|
|
|
|
|
any file that is readable by the user running Galaxy jobs
|
|
|
|
|
on the host where the job runs.
|
|
|
|
|
|
|
|
|
|
Many such "external data source" tools are provided with the Galaxy
|
|
|
|
|
distribution and are enabled by default (most tools under the "Get Data"
|
|
|
|
|
section of the tool panel), meaning that its exploitability is fairly high,
|
|
|
|
|
as only one such tool needs to be enabled to be vulnerable, including any
|
|
|
|
|
custom data source tools (any tool that uses
|
|
|
|
|
`tools/data_source/data_source.py`).
|
|
|
|
|
What files are readable depends entirely upon what the job's user has
|
|
|
|
|
access to read on the host(s) where jobs run.
|
|
|
|
|
|
|
|
|
|
The fix for this issue has been applied to Galaxy releases back to 16.07 and can be found in this `commit <https://github.com/galaxyproject/galaxy/commit/0e698813a96f1ad61d797255686f69cf5e6b1280>`__
|
|
|
|
|
|
|
|
|
|
Cross site scripting and session fixation
|
|
|
|
|
-----------------------------------------
|
|
|
|
|
|
|
|
|
|
Disclosed on the `mailing list <https://lists.galaxyproject.org/pipermail/galaxy-dev/2017-August/025938.html>`__ in August 2017.
|
|
|
|
|
|
|
|
|
|
Vulnerabilities were found by Eric Rasche and Manabu Ishii respectively. Detailed descriptions of these categories of vulnerabilities can be found at:
|
|
|
|
|
|
|
|
|
|
- https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
|
|
|
|
|
- https://www.owasp.org/index.php/Session_fixation
|
|
|
|
|
|
|
|
|
|
The fix for these issues has been applied to Galaxy releases back to 16.10 and can be found in this `diff <https://gist.githubusercontent.com/jmchilton/760bf8ba6055b9a47a48529fcc49a493/raw/01bc98e5a8067a435f38d7cf4fda4e304c4425a2/2017augsecurity_1610.patch>`__
|
|
|
|
|
|
|
|
|
|
.. include:: _thanks.rst
|
|
|
|
|
Nicola Soranzo