February 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1161563] New: VUL-1: CVE-2019-19275: python-typed-ast: out-of-bounds read could crash Python interpreter
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1161563 Bug ID: 1161563 Summary: VUL-1: CVE-2019-19275: python-typed-ast: out-of-bounds read could crash Python interpreter Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/248004/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: sebix+novell.com(a)sebix.at Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-19275 typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.) References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19275 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19275.html https://github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827… https://github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5c… https://github.com/python/typed_ast/commit/156afcb26c198e162504a57caddfe0ac… https://github.com/python/typed_ast/commit/dc317ac9cff859aa84eeabe03fb50049… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19275 https://bugs.python.org/issue36495 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1162554] No image is loaded anymore
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162554 http://bugzilla.suse.com/show_bug.cgi?id=1162554#c12 --- Comment #12 from Petr Gajdos <pgajdos(a)suse.com> --- (examples at https://github.com/pgajdos/apache-rex/tree/master/mod_dumpio-basic and https://github.com/pgajdos/apache-rex/tree/master/mod_logio-basic respectively) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162554] No image is loaded anymore
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162554 http://bugzilla.suse.com/show_bug.cgi?id=1162554#c11 --- Comment #11 from Petr Gajdos <pgajdos(a)suse.com> --- You can perhaps also try to utilize dumpio/logio modules to increase logging experience. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162882] New: Qt apps cannot handle non-ASCII filesystem path if LC_ALL present as empty string in env (libicu-uc blame)
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1162882 Bug ID: 1162882 Summary: Qt apps cannot handle non-ASCII filesystem path if LC_ALL present as empty string in env (libicu-uc blame) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: kossebau(a)kde.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- libicu-uc's ucnv_getDefaultName() returns "US-ASCII" if LC_ALL is set explicitly to an empty string in the environment (compared to not being set at all). As effect e.g. all Qt-based code run where LC_ALL="" is part of the environment variables is not able to handle non-ASCII path in the filesystem. Example: run LC_ALL= kate or okteta, kwrite, etc. and try to load or save a file with non-ascii chars, like German umlauts äöü (ex: "ärger.txt"). Because Qt's QTextCodec::codecForLocale() used for decoding/encoding names from the filesystem is an instance of QIcuCodec (on openSUSE & friends) which queries the system default from libicu-uc by that very ucnv_getDefaultName(). That behaviour of libicu-uc is rather unexpected. And seems also not present on all Linux flavours, e.g. with some versions of Debian & Ubuntu LC_ALL="" was treated the same as not being set. All code I have seen elsewhere handling LC_ALL does not make a difference between being not set or being an empty string, but maps both to: not set. POSIX.1-2017 take on this seems this: "If the LC_ALL environment variable is defined and is not null, the value of LC_ALL shall be used." from https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html Some old commit to libicu once fixed things for Solaris only: https://github.com/unicode-org/icu/commit/a8b1972f9263f481d0c50db709f93da38… Not idea if that code patched there is the code responsible for what we see here, but the pattern (check for a != 0 && *a != \0) would be the same. To reproduce the issue, find a small sample program and build instructions in this comment: https://bugs.documentfoundation.org/show_bug.cgi?id=130080#c18 (that bug is about the wrapper script for starting libreoffice actually resulting in LC_ALL being set to an empty string, thus failing with the Qt/KF platform plugin to handle non-ascii filesystem names). Had no time to look into libicu myself, thus also no proposals what and how to fix/patch here exactly. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1161564] New: External USB exFAT disk can not be accessed
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1161564 Bug ID: 1161564 Summary: External USB exFAT disk can not be accessed Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: 64bit OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: harald.brennich(a)gmx.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 828044 --> http://bugzilla.opensuse.org/attachment.cgi?id=828044&action=edit Output of dmesg when plugging the disk When plugging a newly acquired USB 3 hard disk, the device shows for a short time in lsusb and ls /dev/sd*. However, fdisk -l lists the internal devices and then hangs until the external disk is unplugged. After a short while. the external disk disappears from lsusb and ls /dev/sd*. lsusb: Bus 002 Device 018: ID 2109:0711 VIA Labs, Inc. Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub Bus 001 Device 007: ID 8087:0a2a Intel Corp. Bus 001 Device 005: ID 0bda:58bd Realtek Semiconductor Corp. Bus 001 Device 003: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card Reader Controller Bus 001 Device 006: ID 1241:1503 Belkin Keyboard Bus 001 Device 004: ID 045e:0039 Microsoft Corp. IntelliMouse Optical Bus 001 Device 002: ID 05e3:0608 Genesys Logic, Inc. Hub Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub lsusb -t: /: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 5000M |__ Port 1: Dev 18, If 0, Class=Mass Storage, Driver=usb-storage, 5000M /: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/12p, 480M |__ Port 3: Dev 2, If 0, Class=Hub, Driver=hub/4p, 480M |__ Port 4: Dev 6, If 0, Class=Human Interface Device, Driver=usbhid, 1.5M |__ Port 4: Dev 6, If 1, Class=Human Interface Device, Driver=usbhid, 1.5M |__ Port 3: Dev 4, If 0, Class=Human Interface Device, Driver=usbhid, 1.5M |__ Port 5: Dev 3, If 0, Class=Vendor Specific Class, Driver=rtsx_usb, 480M |__ Port 6: Dev 5, If 0, Class=Video, Driver=uvcvideo, 480M |__ Port 6: Dev 5, If 1, Class=Video, Driver=uvcvideo, 480M |__ Port 8: Dev 7, If 1, Class=Wireless, Driver=btusb, 12M |__ Port 8: Dev 7, If 0, Class=Wireless, Driver=btusb, 12M ls /dev/sd*: /dev/sda /dev/sda2 /dev/sda4 /dev/sdb /dev/sdb2 /dev/sdb4 /dev/sdb6 /dev/sdc /dev/sda1 /dev/sda3 /dev/sda5 /dev/sdb1 /dev/sdb3 /dev/sdb5 /dev/sdb7 /dev/sdc1 dmesg shows an error when trying to setup the device. -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 1156545] New: open-lldp build failed with linux-glibc-devel 5.3
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1156545 Bug ID: 1156545 Summary: open-lldp build failed with linux-glibc-devel 5.3 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: mlin(a)suse.com QA Contact: qa-bugs(a)suse.de CC: lnussel(a)suse.com Found By: --- Blocker: --- fails to build with linux-glibc-devel 5.3 update[0] build log: https://build.opensuse.org/package/live_build_log/openSUSE:Leap:15.2:Stagin… can be the fix https://github.com/intel/openlldp/commit/273caec484cd37c3d96b40b1754ef4c63b… [1] https://build.opensuse.org/request/show/738565 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1162554] No image is loaded anymore
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162554 http://bugzilla.suse.com/show_bug.cgi?id=1162554#c10 --- Comment #10 from Petr Gajdos <pgajdos(a)suse.com> --- curl -v does not work either? What's its log? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162554] No image is loaded anymore
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162554 http://bugzilla.suse.com/show_bug.cgi?id=1162554#c9 --- Comment #9 from Petr Gajdos <pgajdos(a)suse.com> --- LogLevel debug does not reveal something in the logs? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162554] No image is loaded anymore
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162554 http://bugzilla.suse.com/show_bug.cgi?id=1162554#c8 --- Comment #8 from Petr Gajdos <pgajdos(a)suse.com> --- As I said, clients are on other system. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1159538] KIWI creates a redundant btrfs swap subvolume
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1159538 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:13746:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0