April 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1126427] New: On flaky network submitrequest become declined
by bugzilla_noreply＠novell.com 01 Nov '21

01 Nov '21

http://bugzilla.suse.com/show_bug.cgi?id=1126427 Bug ID: 1126427 Summary: On flaky network submitrequest become declined Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: All OS: openSUSE Factory Status: NEW Severity: Critical Priority: P5 - None Component: BuildService Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: werner(a)suse.com QA Contact: adrian(a)suse.com Found By: --- Blocker: --- I see Subject: Request 678166 changed to declined (submit openSUSE:Factory/cdk) [...] Visit https://build.opensuse.org/request/show/678166 State of request 678166 was changed by factory-auto: review -> declined Comment: Output of check script: ERROR: Failed to download "ftp://invisible-island.net/cdk/cdk-5.0-20190220.tgz" Source URLs are not valid. Try "osc service localrun download_files" Actions: - submit security/cdk => openSUSE:Factory/cdk but if I do a download with wget it works! Can we have a more flexible handling at submit requesting time? Something like checking network first and then the host as well as the connections in past *before* setting requests to declined? -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1082249] New: icecream: adjust firewall service to firewalld
by bugzilla_noreply＠novell.com 01 Nov '21

01 Nov '21

http://bugzilla.suse.com/show_bug.cgi?id=1082249 Bug ID: 1082249 Summary: icecream: adjust firewall service to firewalld Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: coolo(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- We are currently in the process of switching the default firewall from SuSEfirewall2 to firewalld for SLE-15 and Leap-15. firewalld ships a bulk of predefined network services already. The icecream ports are not covered by that, however. Since these are special ports not assigned by IANA I suggest you add a custom firewalld XML service file to your package. There are some instructions on how to do this here: https://en.opensuse.org/Firewalld/RPM_Packaging You can/should keep the SuSEfirewall2 service file in the package (for Factory/Tumbleweed) to keep it working until we decide to completely drop it. Thank you. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1154817] New: "cargo build" issues with rust-1.38.0
by bugzilla_noreply＠novell.com 31 Oct '21

31 Oct '21

http://bugzilla.suse.com/show_bug.cgi?id=1154817 Bug ID: 1154817 Summary: "cargo build" issues with rust-1.38.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: rhafer(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am currently trying to build https://github.com/firecracker-microvm/firecracker.git (but other rust project show the same issue) on tumbleweed and always get this: ---------------------- ~/firecracker> cargo build Updating crates.io index error: failed to fetch `https://github.com/rust-lang/crates.io-index` Caused by: invalid version 3 on git_proxy_options; class=Invalid (3) ---------------------- Digging through the upstream bugs report I came accross: https://github.com/rust-lang/rust/issues/63476 Which points at an issue with the libgit2 integration. Which itself leads to https://github.com/rust-lang/git2-rs/issues/458. I am by no means a rust expert but I if I understand correctly the recommendation is to build rust with the bundled libgit2 instead of using the system provide one. Which means we'd need to remove the LIBGIT2_SYS_USE_PKG_CONFIG=1 from our spec files (AFAIU this is also how the package is build on Fedora) Another possible fix is outlined here (and parently in use on FreeBSD): https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=239785 using this patch: https://svnweb.freebsd.org/ports/head/lang/rust-nightly/files/patch-vendor_… -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1099269] New: VUL-0: CVE-2018-1000518: python-websockets: Improper Handling of Highly Compressed Data
by bugzilla_noreply＠novell.com 30 Oct '21

30 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1099269 Bug ID: 1099269 Summary: VUL-0: CVE-2018-1000518: python-websockets: Improper Handling of Highly Compressed Data Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/208939/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-1000518 aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000518 https://github.com/aaugustin/websockets/pull/407 -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1060464] New: electronics/kicad-unstable: Bug
by bugzilla_noreply＠novell.com 30 Oct '21

30 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1060464 Bug ID: 1060464 Summary: electronics/kicad-unstable: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: openSUSE 42.3 Status: NEW Severity: Major Priority: P5 - None Component: 3rd party software Assignee: dmitry(a)roshchin.org Reporter: reisenweber(a)web.de QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- nightly builds are 6 months old compare http://kicad-pcb.org/download/open-suse/ -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1131652] New: VUL-0: CVE-2019-10856: python-jupyter_notebook: an open redirect can occur via an empty netloc
by bugzilla_noreply＠novell.com 29 Oct '21

29 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1131652 Bug ID: 1131652 Summary: VUL-0: CVE-2019-10856: python-jupyter_notebook: an open redirect can occur via an empty netloc Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/228978/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: toddrme2178(a)gmail.com Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-10856 In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10856 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10856 https://github.com/jupyter/notebook/compare/16cf97c...b8e30ea https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-… -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1136083] New: python3-jupyter_qtconsole missing dependency
by bugzilla_noreply＠novell.com 29 Oct '21

29 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1136083 Bug ID: 1136083 Summary: python3-jupyter_qtconsole missing dependency Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: software(a)legisign.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There seems to be a missing dependency in ‘python3-jupyter_qtconsole’. After installing that package, trying to start Python Qt console ends in a complaint of missing pyqt5, pyside, pyside2, and/or pyqt. Installing ‘python3-qt5’ satisfies the dependency. It’s all the more unfortunate that the name of the requirement is NOT the same as what the Python error message claims is missing. I.e., there’s no package ‘pyqt5’ and searching that returns nothing. -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1132927] New: systemd warnings for several services: "PIDFile= references path below legacy directory /var/run/..."
by bugzilla_noreply＠novell.com 28 Oct '21

28 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1132927 Bug ID: 1132927 Summary: systemd warnings for several services: "PIDFile= references path below legacy directory /var/run/..." Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: pujos.michael(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Looking at the output of dmesg with TW 20190418, I see these benign warnings for a few service whose definition probably needs to be updated: [ 5.393636] systemd[1]: /usr/lib/systemd/system/auditd.service:11: PIDFile= references path below legacy directory /var/run/, updating /var/run/auditd.pid → /run/auditd.pid; please update the unit file accordingly. [ 5.400859] systemd[1]: /usr/lib/systemd/system/iscsiuio.service:12: PIDFile= references path below legacy directory /var/run/, updating /var/run/iscsiuio.pid → /run/iscsiuio.pid; please update the unit file accordingly. [ 5.406061] systemd[1]: /usr/lib/systemd/system/display-manager.service:11: PIDFile= references path below legacy directory /var/run/, updating /var/run/displaymanager.pid → /run/displaymanager.pid; please update the unit file accordingly. [ 5.417147] usb 1-14: new full-speed USB device number 6 using xhci_hcd [ 5.417988] systemd[1]: nss-lookup.target: Dependency Before=nss-lookup.target dropped [ 5.422381] systemd[1]: /usr/lib/systemd/system/chronyd.service:13: PIDFile= references path below legacy directory /var/run/, updating /var/run/chrony/chronyd.pid → /run/chrony/chronyd.pid; please update the unit file accordingly. [ 5.426308] systemd[1]: /usr/lib/systemd/system/ntpd.service:14: PIDFile= references path below legacy directory /var/run/, updating /var/run/ntp/ntpd.pid → /run/ntp/ntpd.pid; please update the unit file accordingly. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1111723] New: Out of date package: openSUSE:Factory/binutils
by bugzilla_noreply＠novell.com 25 Oct '21

25 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1111723 Bug ID: 1111723 Summary: Out of date package: openSUSE:Factory/binutils Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: sean(a)suspend.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- https://build.opensuse.org/package/show/openSUSE:Factory/binutils is at 2.31. Current upstream is ftp://ftp.gnu.org/gnu/binutils/binutils-2.31.1.tar.gz. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1113021] New: Out of date package: openSUSE:Factory/xapian-core is out of date
by bugzilla_noreply＠novell.com 25 Oct '21

25 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1113021 Bug ID: 1113021 Summary: Out of date package: openSUSE:Factory/xapian-core is out of date Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: sean(a)suspend.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- https://build.opensuse.org/package/show/openSUSE:Factory/xapian-core is out of date. Current upstream is available at: http://oligarchy.co.uk/xapian/1.4.7/xapian-core-1.4.7.tar.xz. -- You are receiving this mail because: You are on the CC list for the bug.

2 1