November 2020 - openSUSE Bugs - openSUSE Mailing Lists

[opensuse-bugs] [Bug 1176498] Setting IPv6 forwarders for BIND sometimes produces empty /etc/named.d/forwarders.conf
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1176498 https://bugzilla.suse.com/show_bug.cgi?id=1176498#c2 Stefan Schubert <schubi(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |schubi(a)suse.com Resolution|--- |NORESPONSE Flags|needinfo?(srid(a)rkmail.ru) | --- Comment #2 from Stefan Schubert <schubi(a)suse.com> --- This bug is quite old and we have not gotten the requested information. Feel free to reopen the bug if it is still an issue and you can provide requested information. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178278] Patch 0002-grub-install-Avoid-incompleted-install-on-i386-pc.patch is wrong - outdated binaries are installed
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178278 https://bugzilla.suse.com/show_bug.cgi?id=1178278#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2020:3286-1: An update that has four recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1172952,1176062,1177957,1178278 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): grub2-2.04-9.30.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): grub2-2.04-9.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178278] Patch 0002-grub-install-Avoid-incompleted-install-on-i386-pc.patch is wrong - outdated binaries are installed
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178278 https://bugzilla.suse.com/show_bug.cgi?id=1178278#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2020:3287-1: An update that has four recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1172952,1176062,1177957,1178278 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): grub2-2.02-26.40.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): grub2-2.02-26.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 991250] New: VUL-0: CVE-2013-7458: redis: World readable .rediscli_history
by bugzilla_noreply＠novell.com 11 Nov '20

11 Nov '20

http://bugzilla.suse.com/show_bug.cgi?id=991250 Bug ID: 991250 Summary: VUL-0: CVE-2013-7458: redis: World readable .rediscli_history Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: astieger(a)suse.com QA Contact: qa-bugs(a)suse.de CC: kstreitova(a)suse.com, lars.vogdt(a)microfocus.com, michal.hrusecky(a)opensuse.org, mpluskal(a)suse.com, mrueckert(a)suse.com, mseben(a)gmail.com, nix(a)opensuse.org, pth(a)suse.com Found By: Security Response Team Blocker: --- http://seclists.org/oss-sec/2016/q3/189 https://bugs.debian.org/832460 redis-cli stores its history in ~/.rediscli_history, this file is created with permissions 0644. Home folders are world readable as well in debian, so any user can access other users' redis history, including AUTH commands, which include credentials. I've contacted upstream on 2016-05-30 without any reaction at all and discovered this bug was first reported 3 years ago, still unfixed. @RedisLabs keeps referring to their paid support on twitter. Demo: `cat /home/*/.rediscli_history` Upstream report: https://github.com/antirez/redis/issues/3284 https://github.com/antirez/redis/pull/3322 https://github.com/antirez/redis/pull/1418 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7458 http://seclists.org/oss-sec/2016/q3/189 http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-7458.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[opensuse-bugs] [Bug 835815] Redis init script ignores bind address on stop
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=835815 https://bugzilla.suse.com/show_bug.cgi?id=835815#c12 --- Comment #12 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-OU-2020:3291-1: An update that solves 7 vulnerabilities, contains four features and has two fixes is now available. Category: optional (moderate) Bug References: 1002351,1047218,1061967,1064980,1097430,1131555,798455,835815,991250 CVE References: CVE-2013-7458,CVE-2015-8080,CVE-2016-10517,CVE-2016-8339,CVE-2017-15047,CVE-2018-11218,CVE-2018-11219 JIRA References: ECO-2417,ECO-2867,SLE-11578,SLE-12821 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): redis-6.0.8-1.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1064980] VUL-0: CVE-2016-10517: redis: POST and Host: strings lack a check that allows "Cross Protocol Scripting"
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1064980 https://bugzilla.suse.com/show_bug.cgi?id=1064980#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-OU-2020:3291-1: An update that solves 7 vulnerabilities, contains four features and has two fixes is now available. Category: optional (moderate) Bug References: 1002351,1047218,1061967,1064980,1097430,1131555,798455,835815,991250 CVE References: CVE-2013-7458,CVE-2015-8080,CVE-2016-10517,CVE-2016-8339,CVE-2017-15047,CVE-2018-11218,CVE-2018-11219 JIRA References: ECO-2417,ECO-2867,SLE-11578,SLE-12821 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): redis-6.0.8-1.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1061967] VUL-0: CVE-2017-15047: redis: denial of service in clusterLoadConfig function in cluster.c
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1061967 https://bugzilla.suse.com/show_bug.cgi?id=1061967#c11 --- Comment #11 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-OU-2020:3291-1: An update that solves 7 vulnerabilities, contains four features and has two fixes is now available. Category: optional (moderate) Bug References: 1002351,1047218,1061967,1064980,1097430,1131555,798455,835815,991250 CVE References: CVE-2013-7458,CVE-2015-8080,CVE-2016-10517,CVE-2016-8339,CVE-2017-15047,CVE-2018-11218,CVE-2018-11219 JIRA References: ECO-2417,ECO-2867,SLE-11578,SLE-12821 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): redis-6.0.8-1.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1047218] trackerbug: packages do not build reproducibly from including build time
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1047218 https://bugzilla.suse.com/show_bug.cgi?id=1047218#c78 --- Comment #78 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-OU-2020:3291-1: An update that solves 7 vulnerabilities, contains four features and has two fixes is now available. Category: optional (moderate) Bug References: 1002351,1047218,1061967,1064980,1097430,1131555,798455,835815,991250 CVE References: CVE-2013-7458,CVE-2015-8080,CVE-2016-10517,CVE-2016-8339,CVE-2017-15047,CVE-2018-11218,CVE-2018-11219 JIRA References: ECO-2417,ECO-2867,SLE-11578,SLE-12821 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): redis-6.0.8-1.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1002351] VUL-0: CVE-2016-8339: redis: CONFIG SET client-output-buffer-limit Code Execution Vulnerability
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1002351 https://bugzilla.suse.com/show_bug.cgi?id=1002351#c7 --- Comment #7 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-OU-2020:3291-1: An update that solves 7 vulnerabilities, contains four features and has two fixes is now available. Category: optional (moderate) Bug References: 1002351,1047218,1061967,1064980,1097430,1131555,798455,835815,991250 CVE References: CVE-2013-7458,CVE-2015-8080,CVE-2016-10517,CVE-2016-8339,CVE-2017-15047,CVE-2018-11218,CVE-2018-11219 JIRA References: ECO-2417,ECO-2867,SLE-11578,SLE-12821 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): redis-6.0.8-1.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178674] Desktop completely black, no icons after zypper dup
by bugzilla_noreply＠suse.com 11 Nov '20

11 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178674 https://bugzilla.suse.com/show_bug.cgi?id=1178674#c2 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fvogt(a)suse.com, | |teo8976(a)gmail.com Flags| |needinfo?(teo8976(a)gmail.com | |) --- Comment #2 from Fabian Vogt <fvogt(a)suse.com> --- Please provide more details, like which packages were changed and attach log filels (journal, ~/.local/share/sddm/xorg-session.log). -- You are receiving this mail because: You are on the CC list for the bug.

1 0