May 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1139098] VUL-0: CVE-2018-18838: netdata: Log Injection
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1139098 https://bugzilla.suse.com/show_bug.cgi?id=1139098#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0647-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1139094,1139095,1139098 CVE References: CVE-2018-18836,CVE-2018-18837,CVE-2018-18838,CVE-2018-18839 JIRA References: Sources used: openSUSE Leap 15.2 (src): netdata-1.29.3-lp152.4.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1139095] VUL-0: CVE-2018-18837: netdata: HTTP Header Injection
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1139095 https://bugzilla.suse.com/show_bug.cgi?id=1139095#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0647-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1139094,1139095,1139098 CVE References: CVE-2018-18836,CVE-2018-18837,CVE-2018-18838,CVE-2018-18839 JIRA References: Sources used: openSUSE Leap 15.2 (src): netdata-1.29.3-lp152.4.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1139094] VUL-0: CVE-2018-18836: netdata: JSON injection
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1139094 https://bugzilla.suse.com/show_bug.cgi?id=1139094#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0647-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1139094,1139095,1139098 CVE References: CVE-2018-18836,CVE-2018-18837,CVE-2018-18838,CVE-2018-18839 JIRA References: Sources used: openSUSE Leap 15.2 (src): netdata-1.29.3-lp152.4.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1029961] [META] Finalize /bin -> /usr/bin merge
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1029961 https://bugzilla.suse.com/show_bug.cgi?id=1029961#c80 --- Comment #80 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-RU-2021:0645-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1029961 CVE References: JIRA References: Sources used: openSUSE Leap 15.2 (src): f2fs-tools-1.14.0-lp152.4.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1180251] VUL-0: CVE-2020-35573: postsrsd: DoS via a long timestamp tag in an SRS address
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1180251 https://bugzilla.suse.com/show_bug.cgi?id=1180251#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0646-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1180251 CVE References: CVE-2020-35573 JIRA References: Sources used: openSUSE Leap 15.2 (src): postsrsd-1.11-lp152.4.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185525] Please update Gnome Drawing and add to main repo
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1185525 https://bugzilla.suse.com/show_bug.cgi?id=1185525#c3 --- Comment #3 from S. B. <sb56637(a)gmail.com> --- Thanks very much Marcus! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185362] New: fwupd fails to start due to missing dependencies causing a timeout
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185362 Bug ID: 1185362 Summary: fwupd fails to start due to missing dependencies causing a timeout Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jon(a)moozaad.co.uk QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- First hand error is: >fwupdmgr --verbose (fwupdmgr:8079): GLib-DEBUG: 16:29:05.448: setenv()/putenv() are not thread-safe and should not be used after threads are created Failed to connect to daemon: Error calling StartServiceByName for org.freedesktop.fwupd: Failed to activate service 'org.freedesktop.fwupd': timed out (service_start_timeout=25000ms) After some investigation it does actually run but takes a long time to start. >/usr/libexec/fwupd/fwupd --verbose <snip> ERROR:esys:src/tss2-esys/esys_context.c:69:Esys_Initialize() Initialize default tcti. ErrorCode (0x000a000a) <snip> Library is installed > zypper info libtss2-esys0 Information for package libtss2-esys0: -------------------------------------- Repository : Main Repository (OSS) Name : libtss2-esys0 Version : 3.0.3-1.4 Arch : x86_64 Vendor : openSUSE Installed Size : 562.6 KiB Installed : Yes (automatically) Status : up-to-date Source package : tpm2-0-tss-3.0.3-1.4.src Summary : TPM2 Enhanced System API (ESAPI) installing additional components get's us a step further. >zypper in tpm2-0-tss tpm2.0-abrmd >journalctl -u tpm2-abrmd.service -- Logs begin at Wed 2020-01-08 09:10:54 GMT, end at Tue 2021-04-27 16:51:12 BST. -- Apr 27 16:49:30 mudkip.farm systemd[1]: /usr/lib/systemd/system/tpm2-abrmd.service:12: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting al> Apr 27 16:49:30 mudkip.farm systemd[1]: Condition check resulted in TPM2 Access Broker and Resource Management Daemon being skipped. >fwupd 15:51:12:0366 FIXME failed to allocate dbus proxy object: Error calling StartServiceByName for com.intel.tss2.Tabrmd: Failed to activate service 'com.intel.tss2.Tabrmd': timed out (service_start_timeout=25000ms) Looks like there's 2 issues here? Those missing dependencies and then those dependencies need fixing? In both cases, /usr/libexec/fwupd/fwupd does actually end up running ok (missing features) but running it via systemd causes it to timeout. -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1185526] New: Reduce interpreter installed by default
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185526 Bug ID: 1185526 Summary: Reduce interpreter installed by default Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Enhancement Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: slawek(a)lach.art.pl QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Lots of Linux distributions has many interpreter installed (ruby, perl, php, python, etc.). Also, lots of it have installed many libraries to do the same thing. That use hard disk space and do not be needed by normal users, since we have GralVM and WebAssembly. More experienced users, could install interpreter and download source in ruby, perl, php, pyton, etc. to (for example) do not worry about security. WebAssembly could be compilation target from many languages. Also, GralVM is similar and both solutions allows to use libraries written in many languages, but GralVM take focus on that matter. Form of object code of WebAssembly could be compiled into native code, so it's faster than scripts. Also, you have OBS, so compiling ruby to webassembly (for example) could be done on OpenSUSE servers to enhance security, since also sources could been available. Adding WebAssembly or GralVM allows to not put yet another programming language into distribution. Programmer could simply compile into one of them. I known, that it's not too simple to achieve this. There's many libraries, which should been compiled and WebAssembly virtual machine in purpose to running operating system programs is still under development. But, in my opinion, this is good future goal. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1185525] Please update Gnome Drawing and add to main repo
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1185525 https://bugzilla.suse.com/show_bug.cgi?id=1185525#c2 --- Comment #2 from Marcus Meissner <meissner(a)suse.com> --- and a 0.8.0 to graphcis too -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185525] Please update Gnome Drawing and add to main repo
by bugzilla_noreply＠suse.com 01 May '21

01 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1185525 https://bugzilla.suse.com/show_bug.cgi?id=1185525#c1 --- Comment #1 from Marcus Meissner <meissner(a)suse.com> --- i sent a submit request of drawing to factory -- You are receiving this mail because: You are on the CC list for the bug.

1 0