May 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1171115] AUDIT-0: polkit-default-privs: org.freedesktop.login1.* in restrictive profile: KDE hangs on logout when choosing "shut down"
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.suse.com/show_bug.cgi?id=1171115 http://bugzilla.suse.com/show_bug.cgi?id=1171115#c11 --- Comment #11 from Fabian Vogt <fabian(a)ritter-vogt.de> --- (In reply to Fabian Vogt from comment #10) > (In reply to Matthias Gerstner from comment #9) > > (In reply to fabian(a)ritter-vogt.de from comment #8) > > > The Plasma session management is currently undergoing a rewrite anyway, this > > > might be one of the planned changes. > > > > So are you reporting this to upstream now, or are we just hoping that things > > will fix themselves? > > I asked upstream whether this is being done already and if not I'll report > it. Had a quick discussion. "Save yourself and exit" is currently a single step, which can also cause the power action to be cancelled. That's why it runs before the dbus call is made. There is currently work going on to improve this situation in general by adding a feature (a new QCoreApplication attribute) to Qt. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1169826] Computer (2017 Dell) shuts down during linuxrc hardware detection
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.suse.com/show_bug.cgi?id=1169826 http://bugzilla.suse.com/show_bug.cgi?id=1169826#c5 --- Comment #5 from Stefan Hundhammer <shundhammer(a)suse.com> --- Any news on this? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1165449] fixed IP wired ethernet configured via NET installation cmdline replaced by "managed" DHCP in installed system
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.suse.com/show_bug.cgi?id=1165449 http://bugzilla.suse.com/show_bug.cgi?id=1165449#c8 --- Comment #8 from Stefan Hundhammer <shundhammer(a)suse.com> --- Lubos, this is still waiting for input from your side; see comment #5. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1136104] sshd crash with GSSAPIKeyExchange setting
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1136104 http://bugzilla.opensuse.org/show_bug.cgi?id=1136104#c20 Frank Scheiner <scheiner(a)hlrs.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |scheiner(a)hlrs.de --- Comment #20 from Frank Scheiner <scheiner(a)hlrs.de> --- *** Bug 1159097 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1159097] New: OpenSSH 7.9p1-lp151.3.4 source package: Wrong function name used in patch (openssh-7.7p1-gssapi_key_exchange.patch)
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1159097 Bug ID: 1159097 Summary: OpenSSH 7.9p1-lp151.3.4 source package: Wrong function name used in patch (openssh-7.7p1-gssapi_key_exchange.patch) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: scheiner(a)hlrs.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0 Build Identifier: During creation of a GSI and HPN enabled OpenSSH package ([1]) for the GridCF's Grid Community Toolkit we (a colleague of mine and me) discovered an oddity in the "openssh-7.7p1-gssapi_key_exchange.patch" which is part of [2] - the package used as basis for [1]. [1]: https://build.opensuse.org/package/show/home:frank_scheiner:gct/gsi-openssh [2]: http://download.opensuse.org/source/distribution/leap/15.1/repo/oss/src/ope… There we have: ``` 1575 +int 1576 +kexgss_server(struct ssh *ssh) [...] 1603 + const BIGNUM *p, *g, *pub_key; [...] 1650 + DH_set0_pqg(dh, &p, NULL, &g); [...] 1652 + packet_put_bignum2((BIGNUM *)p); 1653 + packet_put_bignum2((BIGNUM *)g); [...] 1745 + DH_get0_key(dh, &pub_key, NULL); [...] 1793 + packet_put_bignum2(pub_key); ``` Specifically line 1650 looks odd, when comparing the arguments (and their types) to the actual interface of the `DH_set0_pqg()` function on e.g. [3]: ``` int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g); ``` ``` void DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g); ``` ... also from [3] would be a better fit here. [3]: https://www.openssl.org/docs/man1.1.1/man3/DH_set0_pqg.html And comparing these specific lines to their counterparts in the OpenSSH 7.9p1 src RPM in Fedora ([4], from the "openssh-7.8p1-gsskex.patch" patch): ``` 1390 +int 1391 +kexgss_server(struct ssh *ssh) [...] 1418 + const BIGNUM *p, *g, *pub_key; [...] 1464 + DH_get0_pqg(dh, &p, NULL, &g); [...] 1466 + packet_put_bignum2((BIGNUM *)p); 1467 + packet_put_bignum2((BIGNUM *)g); [...] 1559 + DH_get0_key(dh, &pub_key, NULL); [...] 1607 + packet_put_bignum2(pub_key); ``` ...it looks like the function name in the openSUSE patch differs and maybe is the result of a typo? [4]: https://kojipkgs.fedoraproject.org/packages/gsi-openssh/7.9p1/7.fc31/src/gs… When compiling with the assumed wrong function name in the openSUSE patch together with our GSI patch(es) (which use the GSSAPI), this creates the following related warnings: ``` gcc -fpie -fstack-protector -pipe -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -I/usr/include/editline -DLDAP_DEPRECATED -DOPENSSL_LOAD_CONF -I/usr/include/globus -DSSHDIR=\"/etc/gsissh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/libexec/gsissh/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/libexec/gsissh/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/libexec/gsissh/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/libexec/gsissh/ssh-pkcs11-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/lib/empty\" -DHAVE_CONFIG_H -c kexgsss.c -o kexgsss.o kexgsss.c: In function ‘kexgss_server’: kexgsss.c:131:32: warning: passing argument 2 of ‘DH_set0_pqg’ from incompatible pointer type [-Wincompatible-pointer-types] DH_set0_pqg(dh, &p, NULL, &g); ^ In file included from /usr/include/openssl/dsa.h:31:0, from sshkey.h:33, from kexgsss.c:37: /usr/include/openssl/dh.h:175:5: note: expected ‘BIGNUM * {aka struct bignum_st *}’ but argument is of type ‘const BIGNUM ** {aka const struct bignum_st **}’ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g); ^~~~~~~~~~~ kexgsss.c:131:42: warning: passing argument 4 of ‘DH_set0_pqg’ from incompatible pointer type [-Wincompatible-pointer-types] DH_set0_pqg(dh, &p, NULL, &g); ^ In file included from /usr/include/openssl/dsa.h:31:0, from sshkey.h:33, from kexgsss.c:37: /usr/include/openssl/dh.h:175:5: note: expected ‘BIGNUM * {aka struct bignum_st *}’ but argument is of type ‘const BIGNUM ** {aka const struct bignum_st **}’ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g); ^~~~~~~~~~~ In file included from packet.h:223:0, from kexgsss.c:41: opacket.h:77:39: warning: passing argument 2 of ‘ssh_packet_put_bignum2’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] ssh_packet_put_bignum2(active_state, (value)) ^ kexgsss.c:275:2: note: in expansion of macro ‘packet_put_bignum2’ packet_put_bignum2(pub_key); ^~~~~~~~~~~~~~~~~~ opacket.h:10:10: note: expected ‘BIGNUM * {aka struct bignum_st *}’ but argument is of type ‘const BIGNUM * {aka const struct bignum_st *}’ void ssh_packet_put_bignum2(struct ssh *, BIGNUM * value); ^~~~~~~~~~~~~~~~~~~~~~ [...] ``` When using the assumed correct function name, these warnings are gone, but a new warning appears due to passing a const var as non-const argument: ``` [ 131s] gcc -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -fpie -fstack-protector -pipe -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -I/usr/include/editline -DLDAP_DEPRECATED -DOPENSSL_LOAD_CONF -I/usr/include/globus -DSSHDIR=\"/etc/gsissh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/gsissh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/lib/gsissh/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/lib/gsissh/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/lib/gsissh/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/lib/gsissh/ssh-pkcs11-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/lib/empty\" -DHAVE_CONFIG_H -c ssh.c -o ssh.o [ 131s] In file included from packet.h:223:0, [ 131s] from kexgsss.c:41: [ 131s] kexgsss.c: In function 'kexgss_server': [ 131s] opacket.h:77:39: warning: passing argument 2 of 'ssh_packet_put_bignum2' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] [ 131s] ssh_packet_put_bignum2(active_state, (value)) [ 131s] ^ [ 131s] kexgsss.c:275:2: note: in expansion of macro 'packet_put_bignum2' [ 131s] packet_put_bignum2(pub_key); [ 131s] ^~~~~~~~~~~~~~~~~~ [ 131s] opacket.h:10:10: note: expected 'BIGNUM * {aka struct bignum_st *}' but argument is of type 'const BIGNUM * {aka const struct bignum_st *}' [ 131s] void ssh_packet_put_bignum2(struct ssh *, BIGNUM * value); [ 131s] ^~~~~~~~~~~~~~~~~~~~~~ ``` What's your opinion on that? Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1170709] MicroOS-release does not own /etc/YaST2/control.xml
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.suse.com/show_bug.cgi?id=1170709 http://bugzilla.suse.com/show_bug.cgi?id=1170709#c9 Ludwig Nussel <lnussel(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(lnussel(a)suse.com) | --- Comment #9 from Ludwig Nussel <lnussel(a)suse.com> --- So far there is no problem, just a random not owned file hanging around that won't get updated. Might turn into a problem in the future, esp when yast implements what Josef explained. So make sense to take the discussion here into consideration. For the issue at hand, short of yast changing to not copy the file as Thorsten suggested I'd go for the "solution" that is used so far in the main product, ie just own control.xml in a package. That way at least we won't have a stale, not owned file hanging around. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1170709] MicroOS-release does not own /etc/YaST2/control.xml
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.suse.com/show_bug.cgi?id=1170709 http://bugzilla.suse.com/show_bug.cgi?id=1170709#c8 Lukas Ocilka <locilka(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lnussel(a)suse.com Flags| |needinfo?(lnussel(a)suse.com) --- Comment #8 from Lukas Ocilka <locilka(a)suse.com> --- Ludwig, could you, please, try to describe what is the problem here? I mean: The real problem that MicroOS, TW, SLES or so runs into because the file is there? We currently assume that the file "might" be needed in the future (and often is). Anything else is just a feature that might or might not pay off. The same applies to copying other files or even logs too. We believe we need that as it's been proven that in majority of cases, this was true. Extending the functionality by decision making process what to copy or not and when needs proper use-cases and planning. Thank you -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1169316] Sensors_detect loads wrong driver for Nuvoton W83677HG-I (NCT5572D/NCT6771F/NCT6772F/NCT6775F) Super IO Sensors
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.suse.com/show_bug.cgi?id=1169316 http://bugzilla.suse.com/show_bug.cgi?id=1169316#c3 Jean Delvare <jdelvare(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS CC| |stuart(a)stella-maris.org.uk Flags| |needinfo?(stuart@stella-mar | |is.org.uk) --- Comment #3 from Jean Delvare <jdelvare(a)suse.com> --- Candidate fix committed, can you please test the package from: https://build.opensuse.org/package/binaries/Base:System/sensors/openSUSE_Fa… and report if sensors-detect now points to the correct driver (nct6775)? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171379] VUL-0: CVE-2020-11888: python-markdown2: Unsanitized input allows for cross-site scripting (XSS)
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.suse.com/show_bug.cgi?id=1171379 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171379] New: VUL-0: CVE-2020-11888: python-markdown2: Unsanitized input allows for cross-site scripting (XSS)
by bugzilla_noreply＠novell.com 07 May '20

07 May '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1171379 Bug ID: 1171379 Summary: VUL-0: CVE-2020-11888: python-markdown2: Unsanitized input allows for cross-site scripting (XSS) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/258029/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: petr(a)cervinka.net Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-11888 An issue was discovered in python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute. Upstream Issue: https://github.com/trentm/python-markdown2/issues/348 References: https://bugzilla.redhat.com/show_bug.cgi?id=1830999 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11888 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-11888.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11888 https://github.com/trentm/python-markdown2/issues/348 -- You are receiving this mail because: You are on the CC list for the bug.

1 0