December 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1216717] New: suse-module-tools: 60-io-scheduler.rules:37 Failed to write ATTR{/sys/devices/virtual/block/dm-0/queue/scheduler}, ignoring: No such file or directory
by bugzilla_noreply＠suse.com 31 May '24

31 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1216717 Bug ID: 1216717 Summary: suse-module-tools: 60-io-scheduler.rules:37 Failed to write ATTR{/sys/devices/virtual/block/dm-0/queue/scheduler}, ignoring: No such file or directory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: martin.wilck(a)suse.com Reporter: antonio.feijoo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Just in case this wasn't reported yet, this error is logged in the journal of a Tumbleweed system with crypto_LUKS devices: Oct 30 15:46:46 localhost (udev-worker)[724]: dm-0: /usr/lib/udev/rules.d/60-io-scheduler.rules:37 Failed to write ATTR{/sys/devices/virtual/block/dm-0/queue/scheduler}, ignoring: No such file or directory Oct 30 15:46:48 localhost (udev-worker)[723]: dm-1: /usr/lib/udev/rules.d/60-io-scheduler.rules:37 Failed to write ATTR{/sys/devices/virtual/block/dm-1/queue/scheduler}, ignoring: No such file or directory # uname -r 6.5.9-1-default # find /sys/devices -name "queue" /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sr0/queue /sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue /sys/devices/virtual/block/dm-1/queue /sys/devices/virtual/block/dm-0/queue # find /sys/devices -name "scheduler" /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sr0/queue/scheduler /sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/scheduler Not happening in systems with a similar setup using previous kernel versions: - ALP Dolomite Build6.8 localhost:~ # uname -r 6.4.11-1-default localhost:~ # find /sys/devices -name "queue" /sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue /sys/devices/virtual/block/dm-0/queue localhost:~ # find /sys/devices -name "scheduler" /sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/scheduler /sys/devices/virtual/block/dm-0/queue/scheduler - Leap 15.5 # uname -r 5.14.21-150500.53-default # find /sys/devices -name "queue" /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sr0/queue /sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue /sys/devices/virtual/block/dm-0/queue # find /sys/devices -name "scheduler" /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sr0/queue/scheduler /sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/scheduler /sys/devices/virtual/block/dm-0/queue/scheduler I don't know if it's a kernel bug or if the udev rule needs to be adjusted. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1213915] New: Kernel panic - illegal instruction (4) at 7fffb6a4f874 nip 7fffb6a4f874 lr 7fffb6a4380c code 1 in ld64.so.2
by bugzilla_noreply＠suse.com 31 May '24

31 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1213915 Bug ID: 1213915 Summary: Kernel panic - illegal instruction (4) at 7fffb6a4f874 nip 7fffb6a4f874 lr 7fffb6a4380c code 1 in ld64.so.2 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: PowerPC-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jrivrain(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868604 --> https://bugzilla.suse.com/attachment.cgi?id=868604&action=edit serial output All ppc64 Tumbleweed tests in Openqa are failing right now with a kernel panic. All the workers are on power8 cpus, this does not happen on a qemu emulated power9 cpu. Example of failing test: https://openqa.opensuse.org/tests/3476697 See attached serial output. -- You are receiving this mail because: You are on the CC list for the bug.

1 30

[Bug 1217807] New: VUL-0: CVE-2023-47633: traefik: 100% CPU usage when self-serving as backend
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217807 Bug ID: 1217807 Summary: VUL-0: CVE-2023-47633: traefik: 100% CPU usage when self-serving as backend Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386934/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47633 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1217804] New: VUL-0: CVE-2023-47106: traefik: incorrect processing of fragment in the URL leads to authorization bypass
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217804 Bug ID: 1217804 Summary: VUL-0: CVE-2023-47106: traefik: incorrect processing of fragment in the URL leads to authorization bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386931/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47106 https://github.com/traefik/traefik/releases/tag/v2.10.6 https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hm -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1217806] New: VUL-0: CVE-2023-47124: traefik: Potential DDoS whith ACME HTTPChallenge
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217806 Bug ID: 1217806 Summary: VUL-0: CVE-2023-47124: traefik: Potential DDoS whith ACME HTTPChallenge Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386932/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47124 https://doc.traefik.io/traefik/https/acme/#dnschallenge https://github.com/traefik/traefik/releases/tag/v2.10.6 https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1215172] New: VUL-0: croc: multiple security issues in croc
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1215172 Bug ID: 1215172 Summary: VUL-0: croc: multiple security issues in croc Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jsmithfpv(a)gmail.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I have reviewed the Croc codebase during the past month and have found a series of security issues, mostly in the area of a receiver of files which can be harmed by a malicious sender. There are now public GitHub issues about the most pressing issues: - possible creation of files in dangerous path location: https://github.com/schollz/croc/issues/593 - Interactive File Overwrite Prompt can be Circumvented by Sending ZIP file: https://github.com/schollz/croc/issues/594 - Escape Sequences in Filenames are not Filtered: https://github.com/schollz/croc/issues/595 - Use of Parts of the Shared Secret as Room Name: https://github.com/schollz/croc/issues/596 - Unencrypted "ips?" Message Leaks Information from the Sender Side: https://github.com/schollz/croc/issues/597 - Shared Secret Passed on Command Line Possibly Leaks to other Local Users: https://github.com/schollz/croc/issues/598 Nothing of this is currently fixed and it sounds like they also won't be fixed for a longer time, because the upstream author is lacking time to take care of this. As maintainers of croc you may be able to help out upstream to fix these issues or you may consider dropping this package from openSUSE until it becomes better. -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1218393] New: Weird screen blanking (power mgmt?) issue
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218393 Bug ID: 1218393 Summary: Weird screen blanking (power mgmt?) issue Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: rs.opensuse(a)spitzenpfeil.org QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- My screen blanks after screen power mgmt kicks in - as expected. Unfortunately the timer doesn't seem to reset. As long as I move the mouse (even after switching to a console) the screen stays on, once any screen update stops, it goes dark. Currently I to run 'xsnow' !! to keep the screen updating, so it doesn't go dark all the time. This is not fun :-( Where to look? CPU: i7-7700T Graphics: HD 630 P.S.: https://forums.opensuse.org/t/internal-lcd-of-laptop-turning-off-comes-back… -- # VERSION="20231222" ID="opensuse-tumbleweed" -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1214653] New: yast2 keyboard do not allow to set bépo (french)
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1214653 Bug ID: 1214653 Summary: yast2 keyboard do not allow to set bépo (french) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: jonathan(a)mercier.paris QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Dear, I give a try to OpenSuse Leap 15, but I am unable to go further as they any way to set bépo layout kexyboard. I try from: 1. Leap installer : as bépo was missing I choose the french layout once installation has finished: 2. sudo yast2 keyboard: same layout proposal than given from installer 3. sudo yast2/zypper search : nothing relevant found The point (2) and (3) was done by trying to find each letter as I own only bépo keyboard. This layout is present on RHEL, RockyLinux 7,8,9 and Fedora. It would be much appreciate to add it Thanks best regards -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1218099] New: VUL-0: CVE-2023-50471: cjson: segmentation violation in function cJSON_InsertItemInArray
by bugzilla_noreply＠suse.com 25 May '24

25 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218099 Bug ID: 1218099 Summary: VUL-0: CVE-2023-50471: cjson: segmentation violation in function cJSON_InsertItemInArray Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/388143/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mardnh(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-50471 https://github.com/DaveGamble/cJSON/issues/802 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1218098] New: VUL-0: CVE-2023-50472: cjson: segmentation violation in function cJSON_SetValuestring
by bugzilla_noreply＠suse.com 25 May '24

25 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218098 Bug ID: 1218098 Summary: VUL-0: CVE-2023-50472: cjson: segmentation violation in function cJSON_SetValuestring Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/388144/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mardnh(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-50472 https://github.com/DaveGamble/cJSON/issues/803 -- You are receiving this mail because: You are on the CC list for the bug.

1 3