October 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1173619] New: VUL-0: unbound: LPE from unbound to root
by bugzilla_noreply＠suse.com 27 Feb '23

27 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1173619 Bug ID: 1173619 Summary: VUL-0: unbound: LPE from unbound to root Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: darin(a)darins.net Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- via security(a)suse.de: I believe to have found a configuration issue in the Unbound package. Or, depending on how you look at it, in the Unbound server itself. 1. Before starting the Unbound server, systemd routinely runs unbound-anchor. From 'systemctl cat unbound': ExecStartPre=/usr/bin/sudo -u unbound /usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem As you can see this process is run as user unbound. 2. The Unbound server writes a pid file before dropping privileges, i.e. as root. It then chown's the file in a second step. 'grep username /etc/unbound/unbound.conf': username: "unbound" And from the Unbound source: https://github.com/NLnetLabs/unbound/blob/2a90e8fa1e22aa75d1cf67a1f71ebbf3f… As you can see in the source, Unbound doesn't check if there is already a symbolic link in place of the pid file. 3. openSUSE configures Unbound to create the pid file in a directory owned by the unbound user. 'grep pidfile /etc/unbound/unbound.conf': pidfile: "/var/run/unbound/unbound.pid" 'cat /usr/lib/tmpfiles.d/unbound.conf': D /run/unbound 0755 unbound unbound - 4. unbound-anchor is a nice little "do-one-thing-and-do-it-right" tool. But if it is compromised, and as it has write permission in the pid file directory and reliably runs before the server, an attacker could easily gain full root privileges by just creating a symbolic link /run/unbound/unbound.pid. 5. IMHO this would be best fixed in openSUSE by creating a root owned /run/unbound directory, or changing the pid file path to /run/unbound.pid or something like that. I think this would have the added advantage that openSUSE could ship and maybe enforce the Unbound AppArmor profile used in Debian and Ubuntu: https://gitlab.com/apparmor/apparmor-profiles/-/blob/master/ubuntu/20.04/us… With the current openSUSE setup there is the problem that if AppArmor filters CAP_DAC_OVERRIDE, Unbound has no permission to create a pid file in /run/unbound anymore. If you have questions please don't hesitate to contact me. Thanks for taking a look. Kind regards, Detlef -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1174051] New: opensuse-community.org links not working
by bugzilla_noreply＠suse.com 19 Feb '23

19 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1174051 Bug ID: 1174051 Summary: opensuse-community.org links not working Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Wiki Assignee: suse-beta(a)cboltz.de Reporter: e-dimas(a)yandex.ru QA Contact: adrian.schroeter(a)suse.com Found By: --- Blocker: --- I am trying to install codecs using "opensuse-community.org" But links to "KDE Codecs", "GNOME Codecs", "NVIDIA Graphics Card Driver" do not work. I use the browser Firefox. If you enter "https://opensuse-community.org/codecs-kde.ymp" in the address bar, the installation of codecs starts. Please fix the links "1 Click Install". -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1174184] New: mozilla/firefox78: Bug
by bugzilla_noreply＠suse.com 19 Feb '23

19 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1174184 Bug ID: 1174184 Summary: mozilla/firefox78: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: 3rd party software Assignee: wolfgang(a)rosenauer.org Reporter: bauglir(a)fsfe.org QA Contact: bnc-team-screening(a)forge.provo.novell.com Found By: --- Blocker: --- Created attachment 839753 --> http://bugzilla.opensuse.org/attachment.cgi?id=839753&action=edit Error message openSuSE Leap 15.2: After upgrading to latest Firefox 78.0.2 version, current profile opens once and then it starts showing an error window with attatched message. There's no problem opening new profiles, just opening old profiles. -- You are receiving this mail because: You are on the CC list for the bug.

1 57

[Bug 1175850] New: MicroOS Desktop can't reboot?
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1175850 Bug ID: 1175850 Summary: MicroOS Desktop can't reboot? Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: mike(a)flingtoad.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- On a default install of MicroOS Desktop (KDE) (ALPHA) 20200824-0, there is no obvious way to reboot the machine after install packaged with transactional-update. Here's what I've tried. 1. 'transactional-update reboot' (notifies rebootmgrctl that a reboot is requested, but 'rebootmgrctl status' seems to be waiting for the scheduled maintenance time. 2. 'rebootmgrctl reboot now' does not seem to do anything. 3. 'rebootmgrctl reboot fast' does not seem to do anything. 4. Click "Leave" -> "Restart" from KDE menu does not seem to do anything. 5. Click "Leave" -> "Shutdown" from KDE menu does not seem to do anything. 6. Click "Leave" -> "Shutdown" from KDE menu does not seem to do anything. 7. 'systemctl reboot' drops to a non-graphical target with login prompt, but doesn't continue with a reboot. 8. 'shutdown -r now' drops to a non-graphical target with login prompt, but doesn't continue with a reboot. 9. 'shutdown -h now' complains about not being able to unmount /etc, but eventually does halt. 10. 'systemctl reboot' to drop to term and the ctrl-alt-delete several times does eventually reboot >From what I can tell, 4-6 only happen when running the X session for KDE. If you run the Wayland session, 4-6 work but the others still don't. I haven't tried Wayland (Full). Other notes and observations: 1. I don't think the X session is starting the org.kde.ksmserver, but it does get started for Wayland. 2. I'm using full-disk encryption. 3. No matter how I exit the KDE session, it never saved my display configuration. I have to reconfigure the displays each time. Perhaps another bug report for this one. -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1165830] New: [TRACKER] grand distro cleanup
by bugzilla_noreply＠novell.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1165830 Bug ID: 1165830 Summary: [TRACKER] grand distro cleanup Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: lnussel(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- track efforts to clean up the distro like /usr move /etc cleanup dependency cleanup -- You are receiving this mail because: You are on the CC list for the bug.

2 21

[Bug 1167519] New: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim
by bugzilla_noreply＠novell.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1167519 Bug ID: 1167519 Summary: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/255622/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: luke(a)ljones.dev Reporter: wolfgang.frisch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-10870 Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10870 https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/1028 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10870 -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1170553] New: [Build 20200425] gnuhealth UI looks broken with GNOME 3.36
by bugzilla_noreply＠novell.com 12 Feb '23

12 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1170553 Bug ID: 1170553 Summary: [Build 20200425] gnuhealth UI looks broken with GNOME 3.36 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/1245677/modules/gnuh ealth_client_preconfigure/steps/6 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- ## Observation openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-gnuhealth@64bit fails in [gnuhealth_client_preconfigure](https://openqa.opensuse.org/tests/1245677/mo… ## Test suite description Maintainer: okurz(a)suse.de Test scenario for gnuhealth software stack ## Reproducible Fails since (at least) Build [20200423](https://openqa.opensuse.org/tests/1245318) ## Expected result Last good: [20200422](https://openqa.opensuse.org/tests/1243312) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1131707] New: VUL-1: CVE-2019-10868: In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no
by bugzilla_noreply＠novell.com 12 Feb '23

12 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1131707 Bug ID: 1131707 Summary: VUL-1: CVE-2019-10868: In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/228999/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: axel.braun(a)gmx.de Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-10868 In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10868 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10868 https://hg.tryton.org/trytond/rev/f58bbfe0aefb https://discuss.tryton.org/t/security-release-for-issue8189/1262 -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1131096] New: [Build 20190329] GNUHealth no longer installable
by bugzilla_noreply＠novell.com 12 Feb '23

12 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1131096 Bug ID: 1131096 Summary: [Build 20190329] GNUHealth no longer installable Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/895777/modules/gnuhe alth_client_install/steps/19 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- ## Observation openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-gnuhealth@64bit fails in [gnuhealth_client_install](https://openqa.opensuse.org/tests/895777/modules/… ## Test suite description Maintainer: okurz(a)suse.de Test scenario for gnuhealth software stack ## Reproducible Fails since (at least) Build [20190328](https://openqa.opensuse.org/tests/894742) ## Expected result Last good: [20190327](https://openqa.opensuse.org/tests/894056) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?flavor=DVD&version=Tumblew… The package python-GooCalendar no longer exists due to changes in https://build.opensuse.org/request/show/689360 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1177260] New: Switching python-numpy to plain BLAS causes significant performance regression
by bugzilla_noreply＠suse.com 08 Feb '23

08 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1177260 Bug ID: 1177260 Summary: Switching python-numpy to plain BLAS causes significant performance regression Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: stefan.bruens(a)rwth-aachen.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- https://build.opensuse.org/request/show/835366 switched numpy to plain BLAS/LAPACK, which causes a significant performance regression: --- import numpy as np import time n = 4000 start_time = time.time() A = np.random.randn(n,n).astype('float64') B = np.random.randn(n,n).astype('float64') print(" init took {} seconds ".format(time.time() - start_time)) start_time = time.time() m = A@B print(" mmult took {} seconds ".format(time.time() - start_time)) print(np.__config__.show()) --- python3-numpy-1.19.1 with openblas: mmult took 2.4579274654388428 seconds python3-numpy-1.19.2 with blas/lapack: mmult took 877.8246397972107 seconds python3-numpy-1.19.2 with openblas: mmult took 2.6917877197265625 seconds MMult 4000x4000 is 64e9 multiplications and additions, thats ~150kOps/s for BLAS/LAPACK. -- You are receiving this mail because: You are on the CC list for the bug.

1 25