March 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1218885] New: VUL-0: CVE-2023-45235: edk2, ovmf: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
by bugzilla_noreply＠suse.com 17 May '24

17 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218885 Bug ID: 1218885 Summary: VUL-0: CVE-2023-45235: edk2, ovmf: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/391383/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45235 https://www.cve.org/CVERecord?id=CVE-2023-45235 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h http://www.openwall.com/lists/oss-security/2024/01/16/2 https://bugzilla.redhat.com/show_bug.cgi?id=2258700 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1218886] New: VUL-0: CVE-2023-45236: edk2, ovmf: Predictable TCP Initial Sequence Numbers
by bugzilla_noreply＠suse.com 17 May '24

17 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218886 Bug ID: 1218886 Summary: VUL-0: CVE-2023-45236: edk2, ovmf: Predictable TCP Initial Sequence Numbers Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/391384/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45236 https://www.cve.org/CVERecord?id=CVE-2023-45236 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h http://www.openwall.com/lists/oss-security/2024/01/16/2 https://bugzilla.redhat.com/show_bug.cgi?id=2258703 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1218887] New: VUL-0: CVE-2023-45237: edk2, ovmf: Use of a Weak PseudoRandom Number Generator
by bugzilla_noreply＠suse.com 17 May '24

17 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218887 Bug ID: 1218887 Summary: VUL-0: CVE-2023-45237: edk2, ovmf: Use of a Weak PseudoRandom Number Generator Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/391385/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45237 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h https://www.cve.org/CVERecord?id=CVE-2023-45237 http://www.openwall.com/lists/oss-security/2024/01/16/2 https://bugzilla.redhat.com/show_bug.cgi?id=2258706 -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1219180] New: Missing framebuffer during boot on aarch64
by bugzilla_noreply＠suse.com 17 May '24

17 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1219180 Bug ID: 1219180 Summary: Missing framebuffer during boot on aarch64 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3891664/modules/ansi ble/steps/31 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de CC: tzimmermann(a)suse.com Target Milestone: --- Found By: openQA Blocker: --- Unless the initrd is built with the platform native DRM driver (e.g. virtio_gpu), there is no graphical output during boot. This also means that entering a passphrase for unlocking the root fs is not possible. On x86 it uses the EFI framebuffer successfully, but on aarch64 dmesg has no trace of efifb/simplefb/simpledrm. ## Observation openQA test in scenario microos-Tumbleweed-MicroOS-Image-sdboot-aarch64-microos-wizard@aarch64 fails in [ansible](https://openqa.opensuse.org/tests/3891664/modules/ansible/steps/31) ## Test suite description Like MicroOS, but use neither combustion nor ignition for the intial configuration, so jeos-firstboot runs. ## Reproducible Fails since (at least) Build [20231129](https://openqa.opensuse.org/tests/3771195) ## Expected result Last good: [20231127](https://openqa.opensuse.org/tests/3763820) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=aarch64&distri=microo… -- You are receiving this mail because: You are on the CC list for the bug.

1 38

[Bug 1217737] New: bpftrace has DWARF support disabled
by bugzilla_noreply＠suse.com 17 May '24

17 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217737 Bug ID: 1217737 Summary: bpftrace has DWARF support disabled Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi, # bpftrace --info |& egrep "DWARF|version" version: v0.19.1 libdw (DWARF support): no Is there any specific reason to keep DWARF support disabled ? If not can it be turned ON to make uprobe more useful ? Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1221160] New: GStreamer: proper support for pipewire
by bugzilla_noreply＠suse.com 17 May '24

17 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1221160 Bug ID: 1221160 Summary: GStreamer: proper support for pipewire Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 873327 --> https://bugzilla.suse.com/attachment.cgi?id=873327&action=edit pipeline from the gst-play-1.0 So Antinio pushed: https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1932/ To support GST_PLUGIN_FEATURE_RANK=pipewiresink:267 or similar. But it looks like PulseSink is still selected as output: LANG=en GST_PLUGIN_FEATURE_RANK=pipewiresink:267 GST_DEBUG_DUMP_DOT_DIR=/tmp gst-play-1.0 /tmp/a.mp3 ; dot -T pdf `ls -rt /tmp/*dot|tail -1` >/tmp/a.pdf -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1221770] New: installation problem for package trousers on leap 15.6 beta
by bugzilla_noreply＠suse.com 17 May '24

17 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1221770 Bug ID: 1221770 Summary: installation problem for package trousers on leap 15.6 beta Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: comes(a)naic.edu QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- While I was testing Leap 15.6 beta (630.1-boot) I saw this error in /var/log/zypp history: # 2024-03-15 00:17:14 trousers-0.3.15-150600.7.1.x86_64.rpm installed ok # Additional rpm output: # Group 'mail' not found. Creating the user mailbox file with 0600 mode. # /var/tmp/rpm-tmp.pxRHp2: line 24: /usr/bin/udevadm: No such file or directory # 2024-03-15 00:17:14|install|trousers|0.3.15-150600.7.1|x86_64||openSUSE-Leap-15.6-1|6462c0eebacd6db401e9c14dbcd79d22e914197ef0716fa9bef3a3476715d8c69bdf65b0b5fbc3a43c42be70277bf3f3d00881c6b6fd41bba174b8c77b8941f5| A similar problem was fixed in tumbleweed with SR#1135798 For Leap 15.6 and 15.5 the change in the spec file should be: Requires(pre): pwdutils +Requires(pre): coreutils +Requires(post): udev BuildRoot: %{_tmppath}/%{name}-%{version}-build -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1221495] New: New Devel Project Request: COSMIC
by bugzilla_noreply＠suse.com 16 May '24

16 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1221495 Bug ID: 1221495 Summary: New Devel Project Request: COSMIC Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: BuildService Assignee: screening-team-bugs(a)suse.de Reporter: rrahl0(a)proton.me QA Contact: adrian.schroeter(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Hey, as I am packaging COSMIC (Desktop Environment), it would make sense to create a new develproject. My attempt are in home:rrahl0:COSMIC. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1215621] New: iscsi initiator setup problem
by bugzilla_noreply＠suse.com 16 May '24

16 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1215621 Bug ID: 1215621 Summary: iscsi initiator setup problem Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: per(a)computer.org QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- I am trying to set up an iscsi initiator using a bnx2 offload device. I am seeing a couple of issues. a) IscsiClientLib.rb - uses ifconfig, which is deprecated. Line 1786. Can be worked around by installing "net-tools-deprecated". See also bug#1215537 b) when trying to connect to a target, I get this error: Connection to discovery portal 10.42.8.10 failed: internal error Error output: iscsiadm: Please set the iface.ipaddress for iface eth4-bnx2i, then retry the login command. c) after having set "iface.ipaddress" manually and retrying the connection: iscsiadm: Could not set host net params (err 29) I believe the above is due to an issue in iscsiuio, I'll open a separate ticket on that. -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1221698] New: GCC 14: libcddb package fails
by bugzilla_noreply＠suse.com 16 May '24

16 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1221698 Bug ID: 1221698 Summary: GCC 14: libcddb package fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: michal.jires(a)suse.com QA Contact: qa-bugs(a)suse.de CC: mcepl(a)suse.com Blocks: 1220571 Target Milestone: --- Found By: --- Blocker: --- Building libcddb with GCC 14 fails here: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… Due to (exhaustive list of errors): cddb_net.c: In function 'timeout_connect': cddb_net.c:328:63: error: passing argument 5 of 'getsockopt' from incompatible pointer type [-Wincompatible-pointer-types] 328 | getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &rv, &l); | ^~ | | | size_t * {aka long unsigned int *} In file included from /usr/include/netinet/in.h:23, from ../include/cddb/cddb_conn.h:32, from ../include/cddb/cddb.h:37, from ../include/cddb/cddb_ni.h:58, from cddb_net.c:22: /usr/include/sys/socket.h:257:46: note: expected 'socklen_t * restrict' {aka 'unsigned int * restrict'} but argument is of type 'size_t *' {aka 'long unsigned int *'} 257 | socklen_t *__restrict __optlen) __THROW; | ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~ See the meta bug#1220571 for more info. -- You are receiving this mail because: You are on the CC list for the bug.

1 5