February 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1123316] YaST2 iSCSI LIO Target does not accept lvm volumes as /dev/vg/lvol for LUN
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.suse.com/show_bug.cgi?id=1123316 http://bugzilla.suse.com/show_bug.cgi?id=1123316#c4 Ancor Gonzalez Sosa <ancor(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ancor(a)suse.com) | --- Comment #4 from Ancor Gonzalez Sosa <ancor(a)suse.com> --- (In reply to Stefan Schubert from comment #3) > Ancor I am not a storage expert, but as far I am remembering we have already > had some issues/discussion about "naming". Could you please check this ? > Thanks ! I don't think this is related at all to the recent problems with yast-storage-ng and names. The code raising that warning does not use yast-storage-ng or libstorage-ng at all. See https://github.com/yast/yast-iscsi-lio-server/blob/830663122701ec3cb21b85a0… That code uses the Ruby method File.ftype to ensure the path correspond to a real, direct file. And /dev/vg/lvol is not a block special file, but a symlink to one (i.e. File.ftype("/dev/vg/lvol") == "link"). It will work if the user introduces something like "/dev/dm-0" (to know the exact file, check which /dev/dm-X is pointed by /dev/vg/lvol). So this works as designed so far (accepting only the block special file and complaining if a symlink is provided). Whether we want to teach yast2-iscsi-lio-server to follow symlinks, that's another question. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1124322] New: VUL-1: CVE-2019-1000021: python-slixmpp: incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub)
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1124322 Bug ID: 1124322 Summary: VUL-1: CVE-2019-1000021: python-slixmpp: incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/224195/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: sor.alexei(a)meowr.ru Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: mvetter(a)suse.com Found By: Security Response Team Blocker: --- CVE-2019-1000021 slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1000021 https://xmpp.org/extensions/xep-0223.html#howitworks https://lab.louiz.org/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85a… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1109687] gnome-news differs between architectures
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.suse.com/show_bug.cgi?id=1109687 http://bugzilla.suse.com/show_bug.cgi?id=1109687#c2 --- Comment #2 from Swamp Workflow Management <swamp(a)suse.de> --- This is an autogenerated message for OBS integration: This bug (1109687) was mentioned in https://build.opensuse.org/request/show/671869 Factory / gnome-weather -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1122193] VUL-0: CVE-2018-20721: uriparser: Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6 addresses with embedded IPv4 address
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.suse.com/show_bug.cgi?id=1122193 http://bugzilla.suse.com/show_bug.cgi?id=1122193#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2019:0228-1: An update that fixes four vulnerabilities is now available. Category: security (low) Bug References: 1115722,1115723,1115724,1122193 CVE References: CVE-2018-19198,CVE-2018-19199,CVE-2018-19200,CVE-2018-20721 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): uriparser-0.8.5-3.5.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1115724] VUL-1: CVE-2018-19200: uriparser: UriCommon.c allows attempted operations on NULL input via a uriResetUri* function
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.suse.com/show_bug.cgi?id=1115724 http://bugzilla.suse.com/show_bug.cgi?id=1115724#c7 --- Comment #7 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2019:0228-1: An update that fixes four vulnerabilities is now available. Category: security (low) Bug References: 1115722,1115723,1115724,1122193 CVE References: CVE-2018-19198,CVE-2018-19199,CVE-2018-19200,CVE-2018-20721 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): uriparser-0.8.5-3.5.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1115723] VUL-0: CVE-2018-19199: uriparser: UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.suse.com/show_bug.cgi?id=1115723 http://bugzilla.suse.com/show_bug.cgi?id=1115723#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2019:0228-1: An update that fixes four vulnerabilities is now available. Category: security (low) Bug References: 1115722,1115723,1115724,1122193 CVE References: CVE-2018-19198,CVE-2018-19199,CVE-2018-19200,CVE-2018-20721 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): uriparser-0.8.5-3.5.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1115722] VUL-0: CVE-2018-19198: uriparser: UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.suse.com/show_bug.cgi?id=1115722 http://bugzilla.suse.com/show_bug.cgi?id=1115722#c7 --- Comment #7 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2019:0228-1: An update that fixes four vulnerabilities is now available. Category: security (low) Bug References: 1115722,1115723,1115724,1122193 CVE References: CVE-2018-19198,CVE-2018-19199,CVE-2018-19200,CVE-2018-20721 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): uriparser-0.8.5-3.5.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1124225] New: Lutris should require typelib-1.0-GTK-3_0
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1124225 Bug ID: 1124225 Summary: Lutris should require typelib-1.0-GTK-3_0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE 42.3 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: jeppe.terndrup(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0 Build Identifier: When installing the Lutris application from the default official repo through Zypper the application fails to launch. This is seemingly due to a missing dependency in typelib-1.0-GTK-3_0, which when manually installed causes the application to launch without problems. Reproducible: Always Steps to Reproduce: 1.Install Lutris through Zypper 2.Attempt to run Lutris application either through Application Menu launcher or by running "lutris" in terminal Actual Results: When launching from Application Menu, the application instantly crashes and closes with no error message. When running through terminal a python GDK dependency error is thrown. Expected Results: Launched normally Upon manually installing typelib-1.0-GTK-3_0 everything works fine. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1124152] /etc/resolv.conf no symlink to /run/netconfig/resolv.conf
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1124152 http://bugzilla.opensuse.org/show_bug.cgi?id=1124152#c5 --- Comment #5 from Anton Smorodskyi <anton.smorodskyi(a)suse.com> --- ah sorry haven't notice , this is most important part : openQA test in scenario sle-15-SP1-Installer-DVD-x86_64-Build156.4-yast2_ncurses@64bit fails in [yast2_dns_server](https://openqa.suse.de/tests/2419837#step/yast2_dns_server/18) with an error popup in the yast dialog to configure a DNS server (bind). Detailed error message: ``` Error occurred while calling netconfig. Error: ATTENTION: /etc/named.d/forwarders.conf is not a link to /var/run/netconfig/bind-forwarders.conf call "netconfig update -f" to adjust /etc/named.d/forwarders.conf ``` not sure how to make bug public but I will try to find out ... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1124152] /etc/resolv.conf no symlink to /run/netconfig/resolv.conf
by bugzilla_noreply＠novell.com 05 Feb '19

05 Feb '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1124152 http://bugzilla.opensuse.org/show_bug.cgi?id=1124152#c4 Christian Boltz <suse-beta(a)cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse-beta(a)cboltz.de --- Comment #4 from Christian Boltz <suse-beta(a)cboltz.de> --- (In reply to Anton Smorodskyi from comment #3) > This behavior is described in > https://bugzilla.suse.com/show_bug.cgi?id=1123985 "You are not authorized to access bug #1123985." Can you please make it public, or at least provide a summary? -- You are receiving this mail because: You are on the CC list for the bug.

1 0