December 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1086778] New: VUL-0: CVE-2018-8970: libressl: The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c inLibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zeroname length, which causes silent omission of hostname verification
by bugzilla_noreply＠novell.com 16 May '22

16 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1086778 Bug ID: 1086778 Summary: VUL-0: CVE-2018-8970: libressl: The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c inLibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zeroname length, which causes silent omission of hostname verification Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/202623/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: jengelh(a)inai.de Reporter: meissner(a)suse.com QA Contact: security-team(a)suse.de CC: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-8970 The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes silent omission of hostname verification, and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported, but the BoringSSL documentation does not. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-8970 http://www.cvedetails.com/cve/CVE-2018-8970/ https://boringssl.googlesource.com/boringssl/+/e759a9cd84198613199259dbed40… https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.1-relnotes.txt https://github.com/libressl-portable/openbsd/commit/0654414afcce51a16d35d05… -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 981004] New: Ensure template unit instances are deleted
by bugzilla_noreply＠novell.com 16 May '22

16 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=981004 Bug ID: 981004 Summary: Ensure template unit instances are deleted Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: Linux Status: NEW Severity: Enhancement Priority: P5 - None Component: Basesystem Assignee: jengelh(a)inai.de Reporter: jengelh(a)inai.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When a package is uninstalled, it will also be removed from the boot sequence, by means of %preun generally calling %service_del_preun foo.service, which expands to (among other things) `systemctl disable foo.service`. To disable template instances such as foo(a)bar.service and foo(a)baz.service, one can - and must, since "bar" and "baz" are not known at any time to the package management system - use `systemctl disable foo@.service`, which will disable all instances. A number of packages are lacking the corresponding %service_del_preun template@.service lines, which means template instance links like foo(a)bar.service will stick around after package uninstall. 389-ds apache2 arpwatch autossh booth chrony cups device-mapper dracut envoy freeipa govpn gpsd kmscon libteam lvm2 lvm2-clvm mariadb mdadm mgetty mysql mysql-community-server openct openvpn parkverbot rear redis rfkill syncthing system-config-printer systemd systemd-mini tomcat vpnc vsftpd wicked xf86-input-wacom -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1133222] New: openSUSE:Leap:15.1/hdf5:gnu-mpich-hpc failed
by bugzilla_noreply＠novell.com 16 May '22

16 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1133222 Bug ID: 1133222 Summary: openSUSE:Leap:15.1/hdf5:gnu-mpich-hpc failed Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://build.opensuse.org/package/live_build_log/open SUSE:Leap:15.1/hdf5:gnu-mpich-hpc/standard/x86_64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: eich(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de CC: adrian(a)suse.com Found By: --- Blocker: --- openSUSE:Leap:15.1/hdf5:gnu-mpich-hpc failed to build. Please see build log: https://build.opensuse.org/package/live_build_log/openSUSE:Leap:15.1/hdf5:g… The job repeatedly gets stuck in [ 2513s] Testing t_cache_image -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1153847] New: Unable to boot with SecureBoot enabled in BIOS
by bugzilla_noreply＠novell.com 15 May '22

15 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1153847 Bug ID: 1153847 Summary: Unable to boot with SecureBoot enabled in BIOS Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: imax(a)posteo.org QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- I'm unable to do a fresh tumbleweed install with SecureBoot enabled. After selecting usb device in boot menu i get a black screen not responding anymore. Pushing Esc after some time leads to an error message with system freeze: Failed to load image: Security Policy Violation When i disable SecureBoot i can boot fine.To exclude possible mistakes: - USB installer created with SUSE ImageWriter - Checksums are all fine - selected right entry in boot menu to boot usb-stick in UEFI mode Other distro's (Ubuntu, Debian, Fedora) officially supporting SecureBoot are working fine out of the box with SecureBoot enabled. With Leap i get the same behavior as described above. Is there something wrong with the signatures? regards -- You are receiving this mail because: You are on the CC list for the bug.

2 14

[Bug 1131686] New: openSUSE-2019-1163 security update for ldb break sssd
by bugzilla_noreply＠novell.com 14 May '22

14 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1131686 Bug ID: 1131686 Summary: openSUSE-2019-1163 security update for ldb break sssd Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: 64bit OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Samba Assignee: samba-maintainers(a)SuSE.de Reporter: pellice(a)gmail.com QA Contact: samba-maintainers(a)SuSE.de Found By: --- Blocker: --- After I applied the openSUSE-2019-1163 security update for ldb sssd service crash at startup: sssd[15186]:ldb: module version mismatch in ../source4/dsdb/samdb/ldb_modules/acl.c : ldb_version=1.2.4 module_version=1.2.3 sssd[15186]: ldb: failed to initialise module /usr/lib64/ldb/samba/acl.so : Unavailable sssd[15186]: ldb: failed to initialise module /usr/lib64/ldb/samba : Unavailable sssd: SSSD couldn't load the configuration database [5]: Input/output error. I reverted it to previous version as a temporary workaround: zypper in --oldpackage libldb1-1.2.3-lp150.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

2 14

[Bug 1131754] New: sssd fails to start due to a ldb module version mismatch (after installing updates on 2019-04-05)
by bugzilla_noreply＠novell.com 14 May '22

14 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1131754 Bug ID: 1131754 Summary: sssd fails to start due to a ldb module version mismatch (after installing updates on 2019-04-05) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Critical Priority: P5 - None Component: Samba Assignee: samba-maintainers(a)SuSE.de Reporter: mhupfer(a)franken-online.de QA Contact: samba-maintainers(a)SuSE.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Build Identifier: # rcsssd status * sssd.service - System Security Services Daemon Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Sat 2019-04-06 11:23:34 CEST; 17min ago Process: 4985 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 4985 (code=exited, status=4) Apr 06 11:23:34 pcito20.leistritz.de systemd[1]: Starting System Security Services Daemon... Apr 06 11:23:34 pcito20.leistritz.de sssd[4985]: ldb: module version mismatch in ../source4/dsdb/samdb/ldb_modules/acl.c : ldb_version=1.2.4 module_version=1.2.3 Apr 06 11:23:34 pcito20.leistritz.de sssd[4985]: ldb: failed to initialise module /usr/lib64/ldb/samba/acl.so : Unavailable Apr 06 11:23:34 pcito20.leistritz.de sssd[4985]: ldb: failed to initialise module /usr/lib64/ldb/samba : Unavailable Apr 06 11:23:34 pcito20.leistritz.de sssd[4985]: SSSD couldn't load the configuration database [5]: Input/output error. Apr 06 11:23:34 pcito20.leistritz.de systemd[1]: sssd.service: Main process exited, code=exited, status=4/NOPERMISSION Apr 06 11:23:34 pcito20.leistritz.de systemd[1]: Failed to start System Security Services Daemon. Apr 06 11:23:34 pcito20.leistritz.de systemd[1]: sssd.service: Unit entered failed state. Apr 06 11:23:34 pcito20.leistritz.de systemd[1]: sssd.service: Failed with result 'exit-code'. Reproducible: Always Steps to Reproduce: 1. zypper up 2. reboot 3. verify sssd status Actual Results: sssd fails to start, domain users cannot log on! Expected Results: sssd starts successfully as it did before the update on Friday, April 5. Previous "zypper up" run was roughly one week before. -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 960478] New: krunner shows inexisting VT sessions in parallel of the existing ones
by bugzilla_noreply＠novell.com 11 May '22

11 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=960478 Bug ID: 960478 Summary: krunner shows inexisting VT sessions in parallel of the existing ones Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: 64bit OS: openSUSE 42.1 Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: stakanov(a)freenet.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 660618 --> http://bugzilla.opensuse.org/attachment.cgi?id=660618&action=edit krunner showing non existing VT sessions in parallel to existing ones Opens a new session with the applet from desktop. You will find that krunner opens as expected but that for every VT session opened there is a "ghost session" showing the very same VT as unused. When you logout from several users these ghosts persist up to a complete reboot. VT sessions once closed should be closed without residual VTs showing up. VT sessions open should not be accompanied by a VT session ghost telling unused session. I attach a screen-shot to make the thing clearer. Repeatable always. -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1086063] New: RPM bad GROUP type/error/duplicate
by bugzilla_noreply＠novell.com 11 May '22

11 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1086063 Bug ID: 1086063 Summary: RPM bad GROUP type/error/duplicate Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)forge.provo.novell.com Reporter: fbourdonnec(a)chez.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 764285 --> http://bugzilla.opensuse.org/attachment.cgi?id=764285&action=edit some screenshot of obvious errors Hello, Each RPM have at least a hierarchical group membership. Supposedly, Yast2 can show them under useful grouping. But nobody cares and the thing is slowly becoming a mess. Just some examples (images in zip files) Developement/Languages/Python/python-castellan Development/Languages/Python/ all other python stuff is here System/Filesystem/f2fs-tools-compat System/Filesystems/all others and so on many Group with on RPM because of typo/duplicate name Games/Arcade/Logic Games/Logic Really RPG & Action ? System/Libraries/KDE/kdiagram-devel !!!! You have also some -devel files disseminated System/I18n/Chineese|Jap/ Strange Java or Office toplevel Groups. Should be something else Communication/Connectivity Adaptation -ofono Really ? Two level for a single tool lib ? System Environment Systems Management Tools Unspecified Utilities are just another name for an existing group Please at least fix obvious errors that are spotted just by looking yast2 rpm packages manager. Thank you -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1159041] New: Leap 15.2 drop requests
by bugzilla_noreply＠novell.com 11 May '22

11 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1159041 Bug ID: 1159041 Summary: Leap 15.2 drop requests Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: christophe(a)krop.fr Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de CC: lubos.kocman(a)suse.com, mlin(a)suse.com Found By: --- Blocker: --- Hey Christophe! thanks for your efforts to take care of Leap. I see you filed a bunch of drop requests for things you consider obsolete. Please keep in mind that 15.2 is a service pack level upgrade. In general the version of the distribution must be considered 15. Users do not expect stuff to break when upgrading between minor version. So just as we try hard to not take away programs from people via maintenance we shouldn't do that in service packs either. The fact that we can do technically should be the exception not the rule. So not maintained upstream anymore or dropped from Factory is not a reason for the Leap 15 series to drop a package. As long as the software works we need to keep it. If the software in question never worked we can just as well get rid of it of course. So I need your confirmation on the following packages on whether they are just dropped for being unmaintained or linking against qt4, or they are actually broken ie unusable: H2rename Qross fate (fate is still used by some departments in SUSE AFAIK) jovie kaccessible kate4-parts kdesdk4-scripts keepassx kepas klinkstatus konsole4-part kpassgen kppp kremotecontrol kuser kvkbd kvpnc libjreen libkdegames4 libkqoauth python-pyside python-pyside-tools tomahawk The following look fine as they are replaced by other bits: jag-level-editor qgo Also, any dropped or replaced packaged should be mentioned in the release notes at https://github.com/openSUSE/release-notes-openSUSE/tree/Leap_15.2/xml -- You are receiving this mail because: You are on the CC list for the bug.

2 19

[Bug 1154971] New: VUL-1: CVE-2019-18359: mp3gain: A buffer over-read was discovered in ReadMP3APETag in apetag.c which might lead to remote denial of service
by bugzilla_noreply＠novell.com 11 May '22

11 May '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1154971 Bug ID: 1154971 Summary: VUL-1: CVE-2019-18359: mp3gain: A buffer over-read was discovered in ReadMP3APETag in apetag.c which might lead to remote denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/245722/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: aloisio(a)gmx.com Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-18359 A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18359 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18359.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18359 https://sourceforge.net/p/mp3gain/bugs/46/ -- You are receiving this mail because: You are on the CC list for the bug.

2 5