December 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 931978] New: VUL-0: CVE-2014-9721: zeromq: protocol downgrade attack on sockets using the ZMTP v3 protocol
by bugzilla_noreply＠novell.com 07 Apr '22

07 Apr '22

http://bugzilla.suse.com/show_bug.cgi?id=931978 Bug ID: 931978 Summary: VUL-0: CVE-2014-9721: zeromq: protocol downgrade attack on sockets using the ZMTP v3 protocol Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: tchvatal(a)suse.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- rh#1221666 ------------------------------------- It was discovered that zeromq, a lightweight messaging kernel, is susceptible to a protocol downgrade attack on sockets using the ZMTP v3 protocol. This could allow remote attackers to bypass ZMTP v3 security mechanisms by sending ZMTP v2 or earlier headers. CVE request: http://openwall.com/lists/oss-security/2015/05/07/8 Upstream bug report: https://github.com/zeromq/libzmq/issues/1273 Upstream fix: https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe… ------------------------------------- References: https://bugzilla.redhat.com/show_bug.cgi?id=1221666 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9721 http://seclists.org/oss-sec/2015/q2/515 http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9721.html -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 953735] New: Change libqt5-creator name to qt5-creator
by bugzilla_noreply＠novell.com 03 Apr '22

03 Apr '22

http://bugzilla.opensuse.org/show_bug.cgi?id=953735 Bug ID: 953735 Summary: Change libqt5-creator name to qt5-creator Classification: openSUSE Product: openSUSE Tumbleweed Version: 2015* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: ronisbr(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi! In Tumbleweed, I have been using the package qt-creator to develop Qt applications for a long time. I have always complained about the old version, since qt-creator is 3.2.2 and the newest version available is 3.5.1. However, it turns out that the newest version is already available in Tumbleweed (and in Leap) under the name libqt5-creator. Is there any good reason to name the package as libqt5-creator? I think this is very confusing. Since it has a lib* in the name, I did not even look at the description, so I was using a very old version all the time. Thus, I am wondering if it is possible to change the name of libqt5-creator to qt5-creator or something else. -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1014929] New: GNOME:Apps/gnucash-docs: Bug
by bugzilla_noreply＠novell.com 01 Apr '22

01 Apr '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1014929 Bug ID: 1014929 Summary: GNOME:Apps/gnucash-docs: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: openSUSE 42.2 Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: adrian.klaver(a)gmail.com QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- Need to add a dependency for yelp to package. Covers the case where the package is being installed on system that is not using GNOME as its desktop, eg using KDE. Without yelp you get the following message when trying to open the GnuCash Help: "GnuCash could not find the files for the help documentation. " even though gnucash-docs is installed. -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1040589] New: bash/gcc/gzip/python differ between builds because of profiling
by bugzilla_noreply＠novell.com 31 Mar '22

31 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1040589 Bug ID: 1040589 Summary: bash/gcc/gzip/python differ between builds because of profiling Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: rguenther(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: matz(a)suse.com Found By: Development Blocker: --- In https://build.opensuse.org/project/prjconf/openSUSE:Factory we have %do_profiling 1 and because of that in our bash.spec we enable gcc's 'profile feedback directed optimizations' but that causes the jobs.o and resulting bash binary to differ between builds, even when running on the same build host. And because of that, build-compare always thinks there is a change and triggers a re-publish and rebuild of depending packages We also have such binary diffs in gcc6 and gcc6.spec calls a make profiledbootstrap The do_profiling macro is used in bash gzip hello python3-base python-base sed xz and in http://rb.zq1.de/compare.factory-20170523/bash-compare.out http://rb.zq1.de/compare.factory-20170523/gcc6-compare.out http://rb.zq1.de/compare.factory-20170523/gzip-compare.out http://rb.zq1.de/compare.factory-20170523/python-base-compare.out http://rb.zq1.de/compare.factory-20170523/python3-base-compare.out we have strange diffs in assembler that I could not trace down to other sources of non-determinism until today. Diffs did go away when building without profiling (it was harder to disable for gcc6 and bash though) Do the profiles just count invocations of functions or do they depend on the type and speed of the system? In the first case, it should be possible to fix the profiling runs to be deterministic, but for that it would be useful to be able to see the differences between runs. How could I diff gcc's .gcda files? -- You are receiving this mail because: You are on the CC list for the bug.

2 15

[Bug 924591] New: Apache2 doesn't start with faulty config, prob from yast
by bugzilla_noreply＠novell.com 14 Mar '22

14 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=924591 Bug ID: 924591 Summary: Apache2 doesn't start with faulty config, prob from yast Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: armv7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: volker3204(a)paradise.net.nz QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Running yast http-server module, making basically no changes to get basic config. No vhosts, ssl, etc. Btw a server name can't be entered, the value is going to /dev/null. Starting apache gives: Mar 27 14:37:35 cubie start_apache2[9361]: Module "authz_default" is not installed, ignoring. Mar 27 14:37:35 cubie start_apache2[9361]: Check the APACHE_MODULES setting in /etc/sysconfig/apache2. Mar 27 14:37:35 cubie start_apache2[9361]: AH00526: Syntax error on line 10 of /etc/apache2/mod_status.conf: Mar 27 14:37:35 cubie start_apache2[9361]: Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration Mar 27 14:37:36 cubie start_apache2[9378]: Module "authz_default" is not installed, ignoring. Mar 27 14:37:36 cubie start_apache2[9378]: Check the APACHE_MODULES setting in /etc/sysconfig/apache2. Mar 27 14:37:36 cubie start_apache2[9378]: AH00526: Syntax error on line 10 of /etc/apache2/mod_status.conf: Mar 27 14:37:36 cubie start_apache2[9378]: Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration Mar 27 14:37:36 cubie systemd[1]: Failed to start The Apache Webserver. In the yast http-server server-modules tab authz_default is listed with a description of "unknown", i.e. none. The module does not exist on disk! Editing /etc/sysconfig/apache2 adding authz_core to APACHE_MODULES makes authz_core also be shown with a description of "unknown". systemctl restart apache2 is now successful. This bnc:835484#6 basically says yast http-server module is foobared, so it's probably best to uninstall it. -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 918705] New: alpine locking failure (against procmail) leads to mail corruption
by bugzilla_noreply＠novell.com 11 Mar '22

11 Mar '22

http://bugzilla.suse.com/show_bug.cgi?id=918705 Bug ID: 918705 Summary: alpine locking failure (against procmail) leads to mail corruption Classification: openSUSE Product: openSUSE Factory Version: 201502* Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: gp(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is something I started to see a bit ago, and since it now happened twice today I figured I'd report it. When I obtain mail via fetchmail, using procmail as the delivery agent, occasionally I get corrupted mails like the following (in mbox format): ==== snip ==== >From gp Thu Feb 19 18:56:54 2015 Mime-Version: 1.0 Date: Thu, 19 Feb 2015 18:56:00 +0100 Subject: AW: Re: Your help needed: Fwd: Comment opportunity: Software Status: RO X-Status: X-Keywords: X-UID: 9310 definedstorage Subject: AW: Re: Your help needed: Fwd: Comment opportunity: Software definedstorage References: <54E302D90200006F00158C8B(a)suse.com> <54E2D72A0200002B000A1B55(a)suse.com> <54E339FA0200006F00158DBD(a)suse.com> <54E2D7DE0200002B000A1B68(a)suse.com> <alpine.LSU.2.11.1502191739290.2252(a)ghan.fvgr> In-Reply-To: <alpine.LSU.2.11.1502191739290.2252(a)ghan.fvgr> Message-ID: <54E623B70200006F001594A6(a)suse.com> From: ... To: "Gerald Pfeifer" <gp(a)suse.com> ==== snap ==== This does not happen daily, and I believe it happens especially when I have been offline for several hours and a few dozen e-mails are delivered at once (though this specific case was not that). The same configuration had been working for years without ever showing this problem, and it looks like looking on the Alpine side (or procmail, though less likely I guess, since it essentially only reads :0 INBOX ) -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1038403] New: NetworkManager: Usage of systemctrl enable should be changed to %sytemd_add_pre/post
by bugzilla_noreply＠novell.com 09 Mar '22

09 Mar '22

http://bugzilla.suse.com/show_bug.cgi?id=1038403 Bug ID: 1038403 Summary: NetworkManager: Usage of systemctrl enable should be changed to %sytemd_add_pre/post Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: sckang(a)suse.com Reporter: behlert(a)suse.com QA Contact: qa-bugs(a)suse.de CC: fcrozat(a)suse.com Found By: --- Blocker: --- "systemctl preset-all" is intended to return service states to a factory state based on presets. But currently we can see breakages in some products due to services that are not following the guidelines as described in https://en.opensuse.org/openSUSE:Systemd_packaging_guidelines#Enabling_syst… The package NetworkManager was identified to use "systemctl enable" in its spec-file, and it should get replaced by the proper use of %sytemd_add_pre/post and preset. Please check your package, thanks. -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1042673] New: vsftpd fails to build with openssl-1.1
by bugzilla_noreply＠novell.com 02 Mar '22

02 Mar '22

http://bugzilla.suse.com/show_bug.cgi?id=1042673 Bug ID: 1042673 Summary: vsftpd fails to build with openssl-1.1 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: peter.simons(a)suse.com Reporter: tchvatal(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1042629 Found By: --- Blocker: --- The package fails to build with openssl-1.1. For more information see the blocker bug. Currently tested in Staging:I https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1042287] New: [Build 20170601] openQA test fails in enlightenment_first_start
by bugzilla_noreply＠novell.com 25 Feb '22

25 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1042287 Bug ID: 1042287 Summary: [Build 20170601] openQA test fails in enlightenment_first_start Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: http://openqa.opensuse.org/tests/413072/modules/enligh tenment_first_start/steps/12 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The description text is missing. ## Observation openQA test in scenario opensuse-Tumbleweed-NET-x86_64-otherDE_enlightenment@64bit fails in [enlightenment_first_start](http://openqa.opensuse.org/tests/413072/modules/… ## Reproducible Fails since (at least) Build [20170601](http://openqa.opensuse.org/tests/412884) ## Expected result Last good: [20170529](http://openqa.opensuse.org/tests/411282) (or more recent) ## Further details Always latest result in this scenario: [latest](http://openqa.opensuse.org/tests/latest?machine=64bit&flavor=NET&te… -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1073845] New: python-attrs andpython-pluggy form a build cycle together
by bugzilla_noreply＠novell.com 18 Feb '22

18 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1073845 Bug ID: 1073845 Summary: python-attrs andpython-pluggy form a build cycle together Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The two packages python-attrs and python-pluggy cause trouble for bootstrapping a distro, since they depend on each other to build -- You are receiving this mail because: You are on the CC list for the bug.

2 4