May 2025 - Nav-users - lister.unit.no

Security announcement: NAV 5.13.1 released
by Morten Brekkevold 11 Jun '25

11 Jun '25

The first maintenance release of the 5.13 series of NAV is now out, and contains a security patch for a serious privilege escalation vulnerability in the web GUI. We recommend that all users upgrade as soon as possible. The source code is available for download at GitHub [1]. New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository. Security ======== - Lock down API access for unprivileged users By default, NAV granted full API access to logged-in users, regardless of their configured privilege level. This would give unprivileged users access to manipulate NAV configuration and even elevate their own user privileges to administrator level. Read the full security advisory at https://github.com/Uninett/nav/security/advisories/GHSA-gprr-5vvf-582g Changed ======= - Update NAPALM dependency to 5.0 to keep NAV web GUI working (#2358) Fixed ===== - Fix filtering of 'Last seen' and sorting by 'Last active' in netbox interfaces view in room info (#3329) Release notes ============= We always advise you to have a look at NAV’s accompanying release notes before upgrading. Happy NAVing everyone! Links ===== [1] https://github.com/Uninett/nav/releases [2] https://nav.uninett.no/install-instructions/#debian [3] https://nav.readthedocs.io/en/latest/release-notes.html#nav-5-13

4 6

Announcement: NAV 5.13.2 released
by Morten Brekkevold 16 May '25

16 May '25

The second maintenance release of the 5.13 series of NAV is now out! The source code is available for download at GitHub [1]. New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository. Fixed ===== - Relax API permissions for endpoints used by NAV web GUI tools intended for non-admin users. Several tools stopped working for non-admin users as a result of the permissions lockdown in the 5.13.1 security fix. - Relax permissions for API interface view endpoint (#3373) - Relax permissions for API prefix usage view endpoint (#3374) - Relax permissions for API list room endpoint (#3375) Release notes ============= We always advise you to have a look at NAV’s accompanying release notes before upgrading. Happy NAVing everyone! Links ===== [1] https://github.com/Uninett/nav/releases [2] https://nav.uninett.no/install-instructions/#debian [3] https://nav.readthedocs.io/en/latest/release-notes.html#nav-5-13 -- Sincerely, Morten Brekkevold Sikt – Norwegian Agency for Shared Services in Education and Research

1 0

Time format is changed in NAV 5.13
by Ingeborg Hellemo 12 May '25

12 May '25

After upgrading to 5.13.0 we notice that the time and date format has changed from "2025-04-26 13:00:00" to "May 7, 2025, 1:36 p.m." Is this a deliberate change in NAV or a result of a change in a library? Most important: How can we get the old format back? --Ingeborg -- Ingeborg Østrem Hellemo -- ingeborg.hellemo(a)uit.no Dep. of Information Technology --- Univ. of Tromsø

2 3