February 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1162775] VUL-1: CVE-2019-15623: nextcloud: Exposure of Private Information causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162775 http://bugzilla.suse.com/show_bug.cgi?id=1162775#c3 --- Comment #3 from Eric Schirra <ecsos(a)schirra.net> --- What have this todo with Leap? Leap have another branch. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162776] VUL-1: CVE-2019-15624: nextcloud: Improper Input Validation allows group admins to create users with IDs of system folders
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162776 Eric Schirra <ecsos(a)schirra.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162778] New: VUL-1: CVE-2019-15619: nextcloud: Improper neutralization of file names, conversation names and board names causes an XSS when linking them with each others in a project
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1162778 Bug ID: 1162778 Summary: VUL-1: CVE-2019-15619: nextcloud: Improper neutralization of file names, conversation names and board names causes an XSS when linking them with each others in a project Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/252410/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-15619 Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15619 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15619 https://hackerone.com/reports/662204 https://nextcloud.com/security/advisory/?id=NC-SA-2020-010 https://nextcloud.com/security/advisory/?id=NC-SA-2020-009 https://nextcloud.com/security/advisory/?id=NC-SA-2020-008 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1162916] YaST removes usrfiles entries from /etc/nsswitch.conf
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162916 http://bugzilla.suse.com/show_bug.cgi?id=1162916#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- This is an autogenerated message for OBS integration: This bug (1162916) was mentioned in https://build.opensuse.org/request/show/770505 Factory / aaa_base -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1161641] New: grub2-install fails with "not a directory" error
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1161641 Bug ID: 1161641 Summary: grub2-install fails with "not a directory" error Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: seife(a)novell.slipkontur.de QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Created attachment 828118 --> http://bugzilla.opensuse.org/attachment.cgi?id=828118&action=edit reproducer script I recently came across a strange grub2-install error when building kiwi images in OBS. The reason is a bug in the minix file system detection. I filed upstream bug https://savannah.gnu.org/bugs/index.php?57652 Note I experienced this on SLES15-SP1. The bug is still present in current Tumbleweed (see attached reproducer script) This bug thus needs fixing in all supported openSUSE releases. The reproducer-script is called as root like # bash ./grub-bug-57652-reproduce-suse.sh /tmp/grub-test.img /mnt /tmp needs 1GB of free storage to store the image. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1085750] The IBM Notes Client 9.0.1 crashes, when started.
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1085750 http://bugzilla.suse.com/show_bug.cgi?id=1085750#c13 --- Comment #13 from Lubos Kocman <lubos.kocman(a)suse.com> --- I did clone but against SLE 15 SP2 Server so our Enterprise counter part is aware of the issue as well. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162925] New: Virtualization:containers/lxc: Bug
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1162925 Bug ID: 1162925 Summary: Virtualization:containers/lxc: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: openSUSE Factory Status: NEW Severity: Major Priority: P5 - None Component: 3rd party software Assignee: opensuse_buildservice(a)ojkastl.de Reporter: kira(a)kiralein.de QA Contact: bnc-team-screening(a)forge.provo.novell.com CC: asarai(a)suse.com, containers-bugowner(a)suse.de, fcastelli(a)suse.com Found By: --- Blocker: --- When using lxc-net with wicked/wickedd (instead of NetworkManager) the startup of the services fails with the following error: ``` Feb 06 03:41:59 mainframe lxc-net[657]: dnsmasq: directory /etc/resolv.conf for resolv-file is missing, cannot poll Feb 06 03:41:59 mainframe dnsmasq[799]: directory /etc/resolv.conf for resolv-file is missing, cannot poll Feb 06 03:41:59 mainframe dnsmasq[799]: FAILED to start up ``` This can easily be fixed by adding ``` After=network.target ``` to the file /usr/lib/systemd/system/lxc-net.service So the whole unit file should look like this: ``` [Unit] Description=LXC network bridge setup After=network-online.target After=network.target Before=lxc.service [Service] Type=oneshot RemainAfterExit=yes ExecStart=/usr/lib/lxc/lxc-net start ExecStop=/usr/lib/lxc/lxc-net stop [Install] WantedBy=multi-user.target ``` Could you please add this line? If needed I can also create a request here on OBS but for that I would first need to setup this package locally etc. kind regards, NRWsoft Inh. Kira M. Backes -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1085750] The IBM Notes Client 9.0.1 crashes, when started.
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1085750 Lubos Kocman <lubos.kocman(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1162952 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1161832] kernel: scsi_dh_alua: module verification failed: signature and/or required key missing - tainting kernel
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1161832 http://bugzilla.suse.com/show_bug.cgi?id=1161832#c10 --- Comment #10 from Jiri Slaby <jslaby(a)suse.com> --- (In reply to Suse User from comment #2) > 5.4.14-1-default #1 SMP Thu Jan 23 08:54:47 UTC 2020 (fc4ea7a) i686 i386 > GNU/Linux BTW do you have so old CPU, that -pae doesn't work on it? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1161832] kernel: scsi_dh_alua: module verification failed: signature and/or required key missing - tainting kernel
by bugzilla_noreply＠novell.com 06 Feb '20

06 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1161832 http://bugzilla.suse.com/show_bug.cgi?id=1161832#c9 Jiri Slaby <jslaby(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED --- Comment #9 from Jiri Slaby <jslaby(a)suse.com> --- (In reply to Jiri Slaby from comment #8) > Looking at a different part of this line now, I see, of course. This is > 32bit. Why does pesign fail completely for 32bit? # XXX: do not sign on x86, as the repackaging changes kernel-pae # from i686 to i586 BRP_PESIGN_FILES="" OK, we should perhaps disable module signing on i386, given we don't generate signatures at all... -- You are receiving this mail because: You are on the CC list for the bug.

1 0