<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi everyone,<br>
<br>
French version below,<br>
<br>
A new build of the Wapt 1.3 branch is available at
<a class="moz-txt-link-freetext" href="https://wapt.tranquil.it/wapt/releases/wapt-1.3.13/">https://wapt.tranquil.it/wapt/releases/wapt-1.3.13/</a> . It includes a
security fix, two bug fixes and two compatibility fixes for upcoming
upgrades to Wapt 1.5 serie (release date yet to be announced).
You'll find more detailed information in the changelog below.<br>
<br>
To upgrade : <a class="moz-txt-link-freetext"
href="https://www.wapt.fr/en/doc/Installation/waptserver_update/index.html">https://www.wapt.fr/en/doc/Installation/waptserver_update/index.html</a>
<p>The Tranquil IT Systems Team.<br>
</p>
<p>=======</p>
<p>Bonjour à tous,</p>
<p>Une nouvelle version de la branche Wapt 1.3 est disponible à
l'adresse <a class="moz-txt-link-freetext" href="https://wapt.tranquil.it/wapt/releases/wapt-1.3.13/">https://wapt.tranquil.it/wapt/releases/wapt-1.3.13/</a><a
moz-do-not-send="true"
href="https://wapt.tranquil.it/wapt/releases/latest/"></a> .
Cette version inclus un correctif de sécurité, deux correctifs de
fonctionnalité et deux améliorations de compatibilité pour
préparer la mise à jour vers la prochaine version Wapt 1.5 (date
de disponibilité pas encore annoncée). Vous trouverez des
informations plus détaillés dans le changelog ci-après.<br>
</p>
<p>Pour la mise à jour : <a class="moz-txt-link-freetext"
href="https://www.wapt.fr/fr/doc/Installation/waptserver_update/index.html">https://www.wapt.fr/fr/doc/Installation/waptserver_update/index.html</a></p>
<p>L'équipe Tranquil IT Systems.</p>
<p>=======</p>
<h1>Changelog<br>
</h1>
<ul>
</ul>
<h2>Security fix:</h2>
<ul>
<li>regression : Package files content check was skipped if
signature of manifest and Packages index file checksum was ok.
This regression affects all 1.3.12 releases, but <u>not </u>Wapt
<= 1.3.9 and >= upcoming 1.5. In order to exploit this
bug, one would need to tamper the Packages files either throught
a MITM (if you don't have valid https certificate check) or a
root access on the wapt server.<br>
</li>
</ul>
<h2>Other changes</h2>
<ul>
<li>Compatibility with packages signed with upcoming Wapt 1.5<br>
</li>
<ul>
<li>With WAPT 1.5, package are signed with sha256 hashes. An
option allows to sign them with sha1 too so that they can be
used with Wapt 1.3 without signing them again.</li>
</ul>
<li>New package certificate for Tranquil IT packages <br>
</li>
<ul>
<li>previous certificate for package on store.wapt.fr has
expired.</li>
<li>all packages on store.wapt.fr has been signed again with new
key/certificate with both sha1 and sha256 hashes, and Wapt 1.5
signature style (control data is signed as well as files)</li>
</ul>
<li>Fix for local GPO add_shutdown_script() function (thanks
jf-guillou !)</li>
<li>Fix for waptsetup.exe postinstall actions (update/register)
when running waptsetup.exe installer without elevated
priviledges : added runascurrentuser flag</li>
<li>Remove needless python libraries to make install package
slimmer<br>
</li>
</ul>
<br>
</body>
</html>