December 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1122855] fpc fails to build on ThunderX2
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1122855 https://bugzilla.suse.com/show_bug.cgi?id=1122855#c11 --- Comment #11 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1122855) was mentioned in https://build.opensuse.org/request/show/856001 15.2 / fpc -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1179225] Enable wireguard in the base kernel package
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1179225 https://bugzilla.suse.com/show_bug.cgi?id=1179225#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1179740] AUDIT-0: please review the security of the dbus profile (com.control.center.qt.systemdbus.conf)
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1179740 https://bugzilla.suse.com/show_bug.cgi?id=1179740#c13 --- Comment #13 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- I looked a bit into the D-Bus service and it all looks pretty strange: ``` QString SysdbusRegister::GetComputerInfo() { QByteArray ba; FILE * fp = NULL; char cmd[128]; char buf[1024]; sprintf(cmd, "dmidecode -t system"); if ((fp = popen(cmd, "r")) != NULL){ rewind(fp); while (!feof(fp)) { fgets(buf, sizeof (buf), fp); ba.append(buf); } pclose(fp); fp = NULL; } return QString(ba); } ``` This doesn't work, because it doesn't find "dmidecode" in the PATH. ``` void SysdbusRegister::setNoPwdLoginStatus(bool status,QString username) { QString cmd; if(true == status){ cmd = QString("gpasswd -a %1 nopasswdlogin").arg(username); } else{ cmd = QString("gpasswd -d %1 nopasswdlogin").arg(username); } QProcess::execute(cmd); } ``` This allows anybody to add or remove anybody else to/from the "nopasswdlogin" group. If at all then this should only be possible for the calling user itself. ``` void SysdbusRegister::setAutoLoginStatus(QString username) { QString filename = "/etc/lightdm/lightdm.conf"; QSharedPointer<QSettings> autoSettings = QSharedPointer<QSettings>(new QSettings(filename, QSettings::IniFormat)); autoSettings->beginGroup("SeatDefaults"); autoSettings->setValue("autologin-user", username); autoSettings->endGroup(); autoSettings->sync(); } ``` This allows to set anybody as the auto-login account in lightdm. This way you can cause the "root" user to autlogin the next time lightdm is started: ``` dbus-send --system --dest=com.control.center.qt.systemdbus --print-reply / com.control.center.interface.setAutoLoginStatus string:root ``` This is not acceptable. Autologin should only be possible for the user itself and/or after root authentication. The D-Bus interface name "com.control.center.qt.systemdbus" is strange. There is missing "ukui" somewhere in this name. And "qt" and "systemdbus" should not belong there. Also the name of the D-Bus service /usr/bin/launchSysDbus is not well chosen. That should be something like ukui-session-service or so. Regarding the polkit action 'org.ukui.groupmanager.action' I don't understand what they're trying to do here at all. It seems this runs as a plugin of the ukui-control-center: ``` bool ChangeGroupDialog::polkit() { PolkitQt1::Authority::Result result; //PolkitQt1::SystemBusNameSubject subject(message().service()); result = PolkitQt1::Authority::instance()->checkAuthorizationSync( "org.ukui.groupmanager.action", PolkitQt1::UnixProcessSubject(QCoreApplication::applicationPid()), PolkitQt1::Authority::AllowUserInteraction); if (result == PolkitQt1::Authority::Yes) { //�� qDebug() << QString("operation authorized"); return true; } else { qDebug() << QString("not authorized"); return false; } } ``` So the control-center asks polkit whether itself is authorized? What purpose should that have? Given all this I can't accept this package into Factory. This needs way more thought. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1179076] enable openssl to create certificates for module signing
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1179076 https://bugzilla.suse.com/show_bug.cgi?id=1179076#c17 --- Comment #17 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1179045] kernel-default fails with rpmlint 2.0
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1179045 https://bugzilla.suse.com/show_bug.cgi?id=1179045#c24 --- Comment #24 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1179015] [rpm4.16] kernel-source build fails
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1179015 https://bugzilla.suse.com/show_bug.cgi?id=1179015#c17 --- Comment #17 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1179014] [rpm4.16] invalid use of barewords in kernel spec files
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1179014 https://bugzilla.suse.com/show_bug.cgi?id=1179014#c15 --- Comment #15 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1178401] errors in OBS builds from kernel+initrd, e.g. "dracut-pre-udev[231]: modprobe: FATAL: Module ext2 not found in directory /lib/modules/5.8.15-1-default"
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1178401 https://bugzilla.suse.com/show_bug.cgi?id=1178401#c24 --- Comment #24 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1178330] Customer kernel module build leaves null.000i.ipa-clones after "make clean"
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1178330 https://bugzilla.suse.com/show_bug.cgi?id=1178330#c48 --- Comment #48 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1178304] No access to NFS4/KRB5 mounts after update to Kernel 5.3.18-lp152.47.2
by bugzilla_noreply＠suse.com 15 Dec '20

15 Dec '20

https://bugzilla.suse.com/show_bug.cgi?id=1178304 https://bugzilla.suse.com/show_bug.cgi?id=1178304#c16 --- Comment #16 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:2260-1: An update that solves 12 vulnerabilities and has 72 fixes is now available. Category: security (important) Bug References: 1149032,1152489,1153274,1154353,1155518,1160634,1166146,1166166,1167030,1167773,1170139,1171073,1171558,1172873,1173504,1174852,1175306,1175918,1176109,1176180,1176200,1176481,1176586,1176855,1176983,1177066,1177070,1177353,1177397,1177577,1177666,1177703,1177820,1178123,1178182,1178227,1178286,1178304,1178330,1178393,1178401,1178426,1178461,1178579,1178581,1178584,1178585,1178589,1178635,1178653,1178659,1178661,1178669,1178686,1178740,1178755,1178762,1178838,1178853,1178886,1179001,1179012,1179014,1179015,1179045,1179076,1179082,1179107,1179140,1179141,1179160,1179201,1179211,1179217,1179225,1179419,1179424,1179425,1179426,1179427,1179429,1179432,1179442,1179550 CVE References: CVE-2020-15436,CVE-2020-15437,CVE-2020-25668,CVE-2020-25669,CVE-2020-25704,CVE-2020-27777,CVE-2020-28915,CVE-2020-28941,CVE-2020-28974,CVE-2020-29369,CVE-2020-29371,CVE-2020-4788 JIRA References: Sources used: openSUSE Leap 15.2 (src): kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0