June 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 991250] New: VUL-0: CVE-2013-7458: redis: World readable .rediscli_history
by bugzilla_noreply＠novell.com 11 Nov '20

11 Nov '20

http://bugzilla.suse.com/show_bug.cgi?id=991250 Bug ID: 991250 Summary: VUL-0: CVE-2013-7458: redis: World readable .rediscli_history Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: astieger(a)suse.com QA Contact: qa-bugs(a)suse.de CC: kstreitova(a)suse.com, lars.vogdt(a)microfocus.com, michal.hrusecky(a)opensuse.org, mpluskal(a)suse.com, mrueckert(a)suse.com, mseben(a)gmail.com, nix(a)opensuse.org, pth(a)suse.com Found By: Security Response Team Blocker: --- http://seclists.org/oss-sec/2016/q3/189 https://bugs.debian.org/832460 redis-cli stores its history in ~/.rediscli_history, this file is created with permissions 0644. Home folders are world readable as well in debian, so any user can access other users' redis history, including AUTH commands, which include credentials. I've contacted upstream on 2016-05-30 without any reaction at all and discovered this bug was first reported 3 years ago, still unfixed. @RedisLabs keeps referring to their paid support on twitter. Demo: `cat /home/*/.rediscli_history` Upstream report: https://github.com/antirez/redis/issues/3284 https://github.com/antirez/redis/pull/3322 https://github.com/antirez/redis/pull/1418 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7458 http://seclists.org/oss-sec/2016/q3/189 http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-7458.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1037468] New: tmux 2.4 consumes a lot of CPU
by bugzilla_noreply＠novell.com 05 Nov '20

05 Nov '20

http://bugzilla.suse.com/show_bug.cgi?id=1037468 Bug ID: 1037468 Summary: tmux 2.4 consumes a lot of CPU Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mimi.vx(a)gmail.com Reporter: osukup(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723672 --> http://bugzilla.suse.com/attachment.cgi?id=723672&action=edit upstream patch more info: https://github.com/tmux/tmux/issues/889 tmux-2.4 with powerline uses permanently 100% of one cpucore -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1043125] New: Internal error at opening "Add System Extensions or Modules" if Software manager opened
by bugzilla_noreply＠novell.com 27 Oct '20

27 Oct '20

http://bugzilla.suse.com/show_bug.cgi?id=1043125 Bug ID: 1043125 Summary: Internal error at opening "Add System Extensions or Modules" if Software manager opened Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: opensuse.lietuviu.kalba(a)gmail.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Today I tested upgrade from openSUSE 42.2 to 42.3. I found two irrelevant modules for openSUSE: - Add System Extensions or Modules - Product Registration. >From curiosity I started "Add System Extensions or Modules" while accidentally simultaniously started Software module. I get warning, that module is locked, but after closing this message, it exited not gracefully: Internal error. Please report a bug report with logs. <...> Caller: /usr/share/YaST2/lib/registration/sw_mgmt.rb:503:in `raise_pkg_exception' More details from y2logs: 2017-06-07 14:47:48 <3> linux.suse(4204) [Ruby] yast/wfm.rb:253 Client call failed with 'Sistemos tvarkytuvę užrakino programa, kurios pid 3952 (/usr/bin/ruby). Užverkite šią programą ir bandykite iš naujo.' (Registration::PkgError) and backtrace ["/usr/share/YaST2/lib/registration/sw_mgmt.rb:503:in `raise_pkg_exception'", "/usr/share/YaST2/lib/registration/sw_mgmt.rb:69:in `init'", "/usr/share/YaST2/clients/scc.rb:50:in `main'", "/usr/share/YaST2/clients/scc.rb:93:in `<top (required)>'", "/usr/lib64/ruby/vendor_ruby/2.1.0/yast/wfm.rb:300:in `eval'", "/usr/lib64/ruby/vendor_ruby/2.1.0/yast/wfm.rb:300:in `run_client'", "/usr/lib64/ruby/vendor_ruby/2.1.0/yast/wfm.rb:206:in `call_builtin'", "/usr/lib64/ruby/vendor_ruby/2.1.0/yast/wfm.rb:206:in `call_builtin_wrapper'", "/usr/lib64/ruby/vendor_ruby/2.1.0/yast/wfm.rb:195:in `CallFunction'", "/usr/lib/YaST2/bin/y2start:56:in `<main>'"] 2017-06-07 14:47:48 <3> linux.suse(4204) [Ruby] yast/wfm.rb:275 Internal error. Please report a bug report with logs. -- You are receiving this mail because: You are on the CC list for the bug.

2 9

[Bug 958524] New: filesystems/cdemu-daemon: Fails to start when user is not member of cdrom
by bugzilla_noreply＠novell.com 14 Oct '20

14 Oct '20

http://bugzilla.opensuse.org/show_bug.cgi?id=958524 Bug ID: 958524 Summary: filesystems/cdemu-daemon: Fails to start when user is not member of cdrom Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: jengelh(a)inai.de Reporter: c.castillo.cast(a)gmail.com QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Depends on: 958517 Found By: --- Blocker: --- Using OpenSUSE Tumbleweed 64 bit and cdemu-daemon 3.0.3 Error cdemu-daemon fails to start when user is not member of cdrom group (see attachment for error message) Solution #gpasswd -a user cdrom log-out log-in Can a message be added to request the user to add himself to the cdrom group? -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 954532] New: Elantech Touchpad on Acer Aspire R11 not detected
by bugzilla_noreply＠novell.com 25 Sep '20

25 Sep '20

http://bugzilla.opensuse.org/show_bug.cgi?id=954532 Bug ID: 954532 Summary: Elantech Touchpad on Acer Aspire R11 not detected Classification: openSUSE Product: openSUSE Tumbleweed Version: 2015* Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: robin.roevens1(a)pandora.be QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Installed Tumbleweed on a brand new Acer Aspire R11 (R3-131T-C56L). Turned out the Touchpad does not work. It is even not listed in /proc/bus/input/devices. The Raydium touchscreen however works correctly. I first tried Leap 42.1 on this machine but had to convert to Tumbleweed since ACPI and the VGA adapter where not correctly supported. BUT the touchpad was detected correctly and worked without problem. On Tumbleweed ACPI and VGA work correctly but no touchpad is detected. When I boot in the Leap Recovery system /proc/bus/input/devices contains this about the touchpad: I: Bus=0011 Vendor=0002 Product=000e Version=0000 N: Name="ETPS/2 Elantech Touchpad" P: Phys=isa0060/serio1/input0 S: Sysfs=/devices/platform/i8042/serio1/input/input4 U: Uniq= H: Handlers=mouse0 event1 B: PROP=5 B: EV=b B: KEY=e420 10000 0 0 0 0 B: ABS=661800011000003 In Tumbleweed it just is not listed. -- You are receiving this mail because: You are on the CC list for the bug.

2 28

[Bug 1029129] New: rpm: drop support for DISABLE_RESTART_ON_UPDATE/DISALBLE_STOP_ON_REMOVAL from /etc/sysconfig/service
by bugzilla_noreply＠novell.com 24 Sep '20

24 Sep '20

http://bugzilla.suse.com/show_bug.cgi?id=1029129 Bug ID: 1029129 Summary: rpm: drop support for DISABLE_RESTART_ON_UPDATE/DISALBLE_STOP_ON_REMOVAL from /etc/sysconfig/service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi, Those 2 global options are used in /etc/sysconfig/services. DISABLE_RESTART_ON_UPDATE=yes, disable the restart of *any* services during package updates which can lead to weak system. IMHO, we shouldn't give the possibility to the user to shoot himself in the foot by providing/suggesting a way to prevent the whole system from being updated properly. In the case where a specific package needs to turn off the "restart on update" or the "stop on removal" features, due to limitation (for instance dbus-1 doesn't support restart at all), then the package can already use some mechanism (Restart=no in the unit file, ...) in its specfile. But that should be disabled (by maintainers) for specific packages only which have good reasons to do so, no turned off globally. Hence I would propose to remove these 2 knobs. -- You are receiving this mail because: You are on the CC list for the bug.

2 20

[Bug 976406] New: rpmlint-mini should not use its own libmagic
by bugzilla_noreply＠novell.com 24 Sep '20

24 Sep '20

http://bugzilla.suse.com/show_bug.cgi?id=976406 Bug ID: 976406 Summary: rpmlint-mini should not use its own libmagic Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: All OS: SUSE Other Status: NEW Severity: Major Priority: P5 - None Component: BuildService Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: werner(a)suse.com QA Contact: adrian(a)suse.com Found By: --- Blocker: --- rpm -qlp ../rpmlint-mini/binaries/rpmlint-mini-1.8-0.x86_64.rpm | grep libmagic /opt/testing/lib64/libmagic.so.1 /opt/testing/lib64/libmagic.so.1.0.0 and exactly this breaks now building Base:System with new file-5.26 as the internal format of the libmagic for its magic files has changed. Note that the API for usage of libmagic has not changed! Currently I try to bootstrap Base:System with an own rpmlint-mini which would not be necessary if rpmlint-mini would use the available libmagic and its magic.mgc. -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1010760] New: sysconfig-netconfig: leftover /tmp/ntp-servers-netconfig.*
by bugzilla_noreply＠novell.com 15 Sep '20

15 Sep '20

http://bugzilla.suse.com/show_bug.cgi?id=1010760 Bug ID: 1010760 Summary: sysconfig-netconfig: leftover /tmp/ntp-servers-netconfig.* Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: mt(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- $ ls -1 /tmp/ntp-servers-netconfig.*|wc -l 4469 You already put the DEST file into /run. How about putting that file there as well and avoid mktemp? -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 968405] New: xdm restarts the user session on update
by bugzilla_noreply＠novell.com 15 Sep '20

15 Sep '20

http://bugzilla.suse.com/show_bug.cgi?id=968405 Bug ID: 968405 Summary: xdm restarts the user session on update Classification: openSUSE Product: openSUSE Tumbleweed Version: 2015* Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: X.Org Assignee: xorg-maintainer-bugs(a)forge.provo.novell.com Reporter: tchvatal(a)suse.com QA Contact: xorg-maintainer-bugs(a)forge.provo.novell.com Found By: --- Blocker: --- When system during update is updating xdm it takes down restarts the graphical user session with everything in it. It seems like the try-restart is not nice in this case enough to simply wait for user to exit the session and just kills everything. -- You are receiving this mail because: You are on the CC list for the bug.

2 56

[Bug 1010996] New: With Firefox 50, ISRG X1 CA to ca-certificates-mozilla should be added
by bugzilla_noreply＠novell.com 26 Aug '20

26 Aug '20

http://bugzilla.suse.com/show_bug.cgi?id=1010996 Bug ID: 1010996 Summary: With Firefox 50, ISRG X1 CA to ca-certificates-mozilla should be added Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: bnc-team-mozilla(a)forge.provo.novell.com Reporter: daniel.molkentin(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- One of Firefox 50's main feature is the inclusion of the ISRG Root X1 CA certificate. This is not reflected in Leap. ca-certificates-mozilla in all distributions, including Tumbleweed and Leap, is still 2.7 from March. Please include ISRG Root X1. -- You are receiving this mail because: You are on the CC list for the bug.

2 23