August 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1139095] New: VUL-0: CVE-2018-18837: netdata: HTTP Header Injection
by bugzilla_noreply＠novell.com 24 Nov '21

24 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1139095 Bug ID: 1139095 Summary: VUL-0: CVE-2018-18837: netdata: HTTP Header Injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/235365/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-18837 An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18837 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18837.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18837 https://www.red4sec.com/cve/netdata_header_injection.txt https://github.com/netdata/netdata/pull/4521 https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b1… https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec9… -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1139094] New: VUL-0: CVE-2018-18836: netdata: JSON injection
by bugzilla_noreply＠novell.com 24 Nov '21

24 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1139094 Bug ID: 1139094 Summary: VUL-0: CVE-2018-18836: netdata: JSON injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/235364/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-18836 An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18836 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18836.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18836 https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec9… https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b1… https://github.com/netdata/netdata/pull/4521 https://www.red4sec.com/cve/netdata_json_injection.txt https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec9… -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 929755] New: shutter is missing perl(Gnome2) in Tumbleweed
by bugzilla_noreply＠novell.com 21 Nov '21

21 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=929755 Bug ID: 929755 Summary: shutter is missing perl(Gnome2) in Tumbleweed Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: f_koch(a)gmx.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36 Build Identifier: flo@linux-mvsa:~> sudo zypper in shutter Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides perl(Gnome2) needed by shutter-0.93.1-1.1.noarch Solution 1: do not install shutter-0.93.1-1.1.noarch Solution 2: break shutter-0.93.1-1.1.noarch by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c] (c): Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1145444] New: Clang8 pulls in old clang-checker6
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1145444 Bug ID: 1145444 Summary: Clang8 pulls in old clang-checker6 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: xaver(a)hellauer.bayern QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- On an up-to-date Tumbleweed (20190809) install, no additional repos, `zypper in clang` would install ``` The following 12 NEW packages are going to be installed: clang clang6-checker clang8 glibc-devel libclang6 libclang8 libLLVM6 libLTO8 libstdc++6-devel-gcc9 libstdc++-devel libxcrypt-devel linux-glibc-devel The following recommended package was automatically selected: clang6-checker ``` while `zypper in clang8` would install ``` The following 11 NEW packages are going to be installed: clang6-checker clang8 glibc-devel libclang6 libclang8 libLLVM6 libLTO8 libstdc++6-devel-gcc9 libstdc++-devel libxcrypt-devel linux-glibc-devel The following recommended package was automatically selected: clang6-checker The following package is recommended, but will not be installed due to conflicts or dependency issues: clang8-checker ``` and `zypper in clang clang-checker` would install ``` The following 6 NEW packages are going to be installed: clang clang8 clang8-checker clang-checker libclang8 libLTO8 The following recommended package was automatically selected: clang8-checker ``` In my opinion all three zypper commands should resolve to the same packages and preferably the latter (no clang6*, libstdc++6* deps). -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1139584] New: LLVM8: inconsistent configuration exposed between cmake and llvm-config
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1139584 Bug ID: 1139584 Summary: LLVM8: inconsistent configuration exposed between cmake and llvm-config Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This issue surfaced while I tried upgrading meson to version 0.51.0 - where a new LLVM test suite has been added The test validates that it makes no difference by what means one would interact with llvm, i.e be it by querying llvm-config or using cmake. Sadly, only openSUSE. said test fails with: [ 621s] meson.build:41:4: ERROR: Assert failed: RTTI information for cmake and config tools disagree And indeed, when inspecting the internas, one gets: > llvm-config --has-rtti YES > grep RTTI /usr/lib64/cmake/llvm/LLVMConfig.cmake set(LLVM_ENABLE_RTTI OFF) So in this case it would actually make a difference to the consumer if they were to use cmake or llvm-config to detect what capabilities our LLVM8 provides. Certainly that is not meant to be like this. -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1133254] New: LTO: llvm[67] build fails
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1133254 Bug ID: 1133254 Summary: LTO: llvm[67] build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails due to: clang-6.0: error: linker command failed with exit code 1 (use -v to see invocation) I would expect the package should use a LTO bootstrap configuration. -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1126907] New: LLVM requires patching to prevent a rustc crash when building Firefox
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1126907 Bug ID: 1126907 Summary: LLVM requires patching to prevent a rustc crash when building Firefox Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: jones_ld(a)protonmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- LLVM 7 has a bug in the discriminator code which causes a crash in rustc when building Firefox (and many other projects). The patches required are here, along with the discussion: https://github.com/rust-lang/rust/issues/57762#issuecomment-456155466 -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1120098] New: Clang 7 packaging is inconsistent
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1120098 Bug ID: 1120098 Summary: Clang 7 packaging is inconsistent Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: aaronpuchert(a)alice-dsl.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- In llvm7.spec, the Clang binaries are renamed: # Fix the clang -> clang-X.Y symlink to work with update-alternatives mv %{buildroot}%{_bindir}/clang-%{_sonum} %{buildroot}%{_bindir}/clang ln -s %{_bindir}/clang-%{_relver} %{buildroot}%{_bindir}/clang-%{_minor} but the installed CMake files (in /usr/lib64/cmake/clang/) aren't changed accordingly. This makes it hard to build software that uses libclang. (I came across this when trying to update include-what-you-use.) The issue is easy to reproduce. Just create a folder with a CMakeLists.txt having just this line: find_package(Clang CONFIG REQUIRED) Then run "cmake ." and there will be an error message like CMake Error at /usr/lib64/cmake/clang/ClangTargets.cmake:296 (message): The imported target "clang" references the file "/usr/bin/clang-7" but this file does not exist. Possible reasons include: [...] Indeed, we have * /usr/bin/clang -> /etc/alternatives/clang -> /usr/bin/clang-7.0.0 * /usr/bin/clang-7.0 -> /usr/bin/clang-7.0.0 but no /usr/bin/clang-7. That is a bit unusual. On the other hand for gcc, we have * /usr/bin/gcc -> /usr/bin/gcc-8 -- You are receiving this mail because: You are on the CC list for the bug.

2 9

[Bug 1119092] New: llvm7: libLLVM is ABI incompatible between GCC and CLANG
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1119092 Bug ID: 1119092 Summary: llvm7: libLLVM is ABI incompatible between GCC and CLANG Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: msrb(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There is a clang-specific optimization in llvm::Optional, which makes code compiled with gcc and clang incompatible with each other. We build libLLVM, libclang, etc using clang, but the rest of the distribution is build using gcc. So anything that links against libLLVM, libclang, etc may be broken. Bug that introduced the clang-only optimization: https://bugs.llvm.org/show_bug.cgi?id=35978 Fix (removing the optimization from everywhere): https://reviews.llvm.org/D50710 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1112730] New: llvm opt-viewer can not find style.css
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1112730 Bug ID: 1112730 Summary: llvm opt-viewer can not find style.css Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: msrb(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Using opt-viewer fails with: FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/style.css' The opt-viewer script is installed in /usr/bin and looks for "style.css" in its own directory, but "style.css" is installed in /usr/share/opt-viewer. LLVM by default installs all opt* tools in /usr/share/opt-viewer, but we move them to /usr/bin to follow our packaging rules. The opt-viewer needs to be patched to find the file. -- You are receiving this mail because: You are on the CC list for the bug.

2 2