October 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1151557] server:monitoring/golang-github-prometheus-node_exporter: Bug: /etc/sysconfig/prometheus-node_exporter is missing
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1151557 https://bugzilla.suse.com/show_bug.cgi?id=1151557#c11 --- Comment #11 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2020:2832-1: An update that has 7 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1151557,1174423,1174636,1175512,1175889,1176500,1176503 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Proxy 4.1 (src): golang-github-QubitProducts-exporter_exporter-0.4.0-6.9.4, golang-github-prometheus-node_exporter-1.0.1-3.3.4, mgr-daemon-4.1.2-2.3.3, patterns-suse-manager-4.1-6.6.3, spacecmd-4.1.7-4.6.3, spacewalk-backend-4.1.15-4.8.4, spacewalk-certs-tools-4.1.13-3.6.3, spacewalk-client-tools-4.1.6-4.3.3, spacewalk-web-4.1.18-3.6.3, susemanager-build-keys-15.2.1-3.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1151557] server:monitoring/golang-github-prometheus-node_exporter: Bug: /etc/sysconfig/prometheus-node_exporter is missing
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1151557 https://bugzilla.suse.com/show_bug.cgi?id=1151557#c10 --- Comment #10 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2020:2848-1: An update that has 22 recommended fixes can now be installed. Category: recommended (low) Bug References: 1151557,1165287,1165829,1171836,1172079,1172263,1173073,1173520,1173603,1173621,1174025,1174254,1174357,1174423,1174636,1175512,1175529,1175545,1175556,1175889,1176500,1176503 CVE References: JIRA References: Sources used: SUSE Manager Server 4.1 (src): release-notes-susemanager-4.1.2-3.21.1 SUSE Manager Retail Branch Server 4.1 (src): release-notes-susemanager-proxy-4.1.2-3.14.1 SUSE Manager Proxy 4.1 (src): release-notes-susemanager-proxy-4.1.2-3.14.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1151557] server:monitoring/golang-github-prometheus-node_exporter: Bug: /etc/sysconfig/prometheus-node_exporter is missing
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1151557 https://bugzilla.suse.com/show_bug.cgi?id=1151557#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2020:2841-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1151557 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): golang-github-prometheus-node_exporter-1.0.1-3.9.1 SUSE Linux Enterprise Server 15-LTSS (src): golang-github-prometheus-node_exporter-1.0.1-3.9.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): golang-github-prometheus-node_exporter-1.0.1-3.9.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): golang-github-prometheus-node_exporter-1.0.1-3.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1151557] server:monitoring/golang-github-prometheus-node_exporter: Bug: /etc/sysconfig/prometheus-node_exporter is missing
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1151557 https://bugzilla.suse.com/show_bug.cgi?id=1151557#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2020:2842-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1151557 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (src): golang-github-prometheus-node_exporter-1.0.1-3.6.1 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0 (src): golang-github-prometheus-node_exporter-1.0.1-3.6.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): golang-github-prometheus-node_exporter-1.0.1-3.6.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): golang-github-prometheus-node_exporter-1.0.1-3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1176742] AUDIT-0: plasma5-disks (suse-dbus-unauthorized-service, polkit-untracked-privilege)
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1176742 https://bugzilla.suse.com/show_bug.cgi?id=1176742#c6 --- Comment #6 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to fvogt(a)suse.com from comment #4) > (In reply to Matthias Gerstner from comment #3) > > (In reply to fvogt(a)suse.com from comment #1) > > > I had a quick look at the helper and while it prevents arbitrary arguments > > > to be passed (the absolute path has to be below /dev), this can probably be > > > circumvented by sending a file descriptor over dbus and passing /dev/fd/X > > > (should be predictable) as argument. > > > > Yes this would be possible, but it requires the attacker to open the file in > > advance (i.e. he needs to have certain access rights anyway). It could be > > combined with a symlink attack in the path that /dev/fd/X is pointing to. > > Shouldn't even be necessary. open with O_PATH doesn't require privileges like > that and smartctl seems to dereference the passed path anyway... This is only partly valid. For opening with O_PATH you still need execute permission on the involved directories. > Definitely. IIRC I've heard of a library which implements several of such > primitives in a secure way, so if that's license compatible it could be used > (or copied, as it's past dep freeze). I don't know where I found that anymore > though, maybe you know something? Yes the library that Malte mentioned probably. I'm not sure if it is production ready yet, though. Since the KDE seems to have a lot of uses cases of this kind it could also be a solution to provide this path security check algorithm in some suitable framework library. Most of the time what is needed is simply a path that is known not to be under control of anybody else but root. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1172686] nodejs8/10/12 fail on ReqWrapList test with GCC10 on aarch64
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1172686 https://bugzilla.suse.com/show_bug.cgi?id=1172686#c21 --- Comment #21 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2020:2829-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1172686,1173937,1176589 CVE References: CVE-2020-15095,CVE-2020-8252 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): nodejs10-10.22.1-1.27.1 SUSE Linux Enterprise Server 15-LTSS (src): nodejs10-10.22.1-1.27.1 SUSE Linux Enterprise Module for Web Scripting 15-SP2 (src): nodejs10-10.22.1-1.27.1 SUSE Linux Enterprise Module for Web Scripting 15-SP1 (src): nodejs10-10.22.1-1.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): nodejs10-10.22.1-1.27.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): nodejs10-10.22.1-1.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1151557] server:monitoring/golang-github-prometheus-node_exporter: Bug: /etc/sysconfig/prometheus-node_exporter is missing
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1151557 https://bugzilla.suse.com/show_bug.cgi?id=1151557#c7 --- Comment #7 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2020:2837-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1151557,1175889 CVE References: JIRA References: Sources used: SUSE Manager Tools 12 (src): golang-github-QubitProducts-exporter_exporter-0.4.0-1.3.1, golang-github-prometheus-node_exporter-1.0.1-1.9.1, mgr-daemon-4.1.2-1.17.1, spacecmd-4.1.7-38.67.1, spacewalk-client-tools-4.1.6-52.35.1 SUSE Linux Enterprise Server 12-SP5 (src): golang-github-prometheus-node_exporter-1.0.1-1.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1177175] New: createrepo_c skips rpms without failing
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1177175 Bug ID: 1177175 Summary: createrepo_c skips rpms without failing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: adrian.schroeter(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- We have since createrepo_c update to 0.16 many broken repositories in OBS, because createrepo_c may skip rpms and is not failing. This leads to inconsistent repostiories which basically break installations. This is not visible to OBS and neither to the users. example lines of createrepo_c: C_CREATEREPOLIB: Critical: Cannot dump XML for rubygem-parser-2_3 (997508f2146125fd1ad896ec7cb6fe94d27fef3ceccb74c339c415e2d76f72e8): Forbidden control chars found (ASCII values <32 except 9, 10 and 13). -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1176742] AUDIT-0: plasma5-disks (suse-dbus-unauthorized-service, polkit-untracked-privilege)
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1176742 https://bugzilla.suse.com/show_bug.cgi?id=1176742#c5 Malte Kraus <malte.kraus(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |malte.kraus(a)suse.com --- Comment #5 from Malte Kraus <malte.kraus(a)suse.com> --- (In reply to Fabian Vogt from comment #4) > > Definitely. IIRC I've heard of a library which implements several of such > primitives in a secure way, so if that's license compatible it could be used > (or copied, as it's past dep freeze). I don't know where I found that anymore > though, maybe you know something? > You may be thinking of https://github.com/openSUSE/libpathrs -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1176091] Microphone not working / sof-firmware kernel 5.8.4
by bugzilla_noreply＠suse.com 02 Oct '20

02 Oct '20

https://bugzilla.suse.com/show_bug.cgi?id=1176091 https://bugzilla.suse.com/show_bug.cgi?id=1176091#c8 --- Comment #8 from jean-christophe baptiste <jc(a)phocean.net> --- Done with Pulseaudio 13.99 and nothing better. -- You are receiving this mail because: You are on the CC list for the bug.

1 0