July 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1173614] New: VUL-0: CVE-2019-15608: yarn: TOCTOU vulnerability leads to cache pollution
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173614 Bug ID: 1173614 Summary: VUL-0: CVE-2019-15608: yarn: TOCTOU vulnerability leads to cache pollution Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/255125/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-15608 The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. References: https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190 https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297… https://hackerone.com/reports/703138 References: https://bugzilla.redhat.com/show_bug.cgi?id=1851875 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15608 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15608.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15608 https://hackerone.com/reports/703138 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1104588] New: unable to configure /tmp using tmpfs
by bugzilla_noreply＠novell.com 02 Jul '20

02 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1104588 Bug ID: 1104588 Summary: unable to configure /tmp using tmpfs Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: jcdole(a)free.fr QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Up to Leap 42.3 you have the possibility to have "/tmp" using "tmpfs". In the partitioner you have the option to add partition using tmpfs : see http://paste.opensuse.org/87010584 This options is also indicated in : http://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.ref… This is missing on leap 15.0 Any comment is welcome. -- You are receiving this mail because: You are on the CC list for the bug.

2 9

[Bug 1172387] sync custom rpi3 config not owned by packages
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1172387 Guillaume GARDET <guillaume.gardet(a)arm.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|guillaume.gardet(a)opensuse.o |guillaume.gardet(a)arm.com |rg | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1172387] sync custom rpi3 config not owned by packages
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1172387 https://bugzilla.suse.com/show_bug.cgi?id=1172387#c4 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dmueller(a)suse.com Assignee|kubic-bugs(a)opensuse.org |guillaume.gardet(a)opensuse.o | |rg --- Comment #4 from Fabian Vogt <fvogt(a)suse.com> --- On TW, it's part of the raspberrypi-firmware package now and no longer written by openSUSE-MicroOS or kiwi-templates-JeOS. openSUSE:Factory:ARM:Live/JeOS still writes that, reassinging. Not sure whether all of those workarounds can be dropped. It also still disables HDMI hotplug. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173106] zypper purge-kernels removes packages which shouldn't be removed
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173106 https://bugzilla.suse.com/show_bug.cgi?id=1173106#c12 --- Comment #12 from Michael Andres <ma(a)suse.com> --- Thanks Michal, also for your support in RC. We're about to revisit the whole workflow. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1168162] New: Mozilla-nss ppc64le build failures "declared 'static' but never defined [-Werror=unused-function]"
by bugzilla_noreply＠novell.com 02 Jul '20

02 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1168162 Bug ID: 1168162 Summary: Mozilla-nss ppc64le build failures "declared 'static' but never defined [-Werror=unused-function]" Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: normand(a)linux.vnet.ibm.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 834330 --> http://bugzilla.opensuse.org/attachment.cgi?id=834330&action=edit mozilla_nss_openSUSE_Factory_PowerPC_ppc64le_202003311144.log Mozilla-nss ppc64le build failures "declared 'static' but never defined [-Werror=unused-function]" failures in Factory:PowerPC since 20200314 (version 3.50) still failure with last 3.51 in Mozilla:Factory project. extract build log: === [ 222s] verified/kremlin/kremlib/dist/minimal/FStar_UInt128.h:22:1: error: 'FStar_UInt128___proj__Mkuint128__item__low' declared 'static' but never defined [-Werror=unused-function] [ 222s] 22 | FStar_UInt128___proj__Mkuint128__item__low(FStar_UInt128_uint128 projectee); [ 222s] | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [ 222s] verified/kremlin/kremlib/dist/minimal/FStar_UInt128.h:25:1: error: 'FStar_UInt128___proj__Mkuint128__item__high' declared 'static' but never defined [-Werror=unused-function] [ 222s] 25 | FStar_UInt128___proj__Mkuint128__item__high(FStar_UInt128_uint128 projectee); [ 222s] | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ === -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1173611] New: Mozilla-nss ppc64le build failure "fips - softokn: crypto test failed - aborting"
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173611 Bug ID: 1173611 Summary: Mozilla-nss ppc64le build failure "fips - softokn: crypto test failed - aborting" Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: normand(a)linux.vnet.ibm.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 839286 --> http://bugzilla.opensuse.org/attachment.cgi?id=839286&action=edit mozilla_nss_openSUSE_Factory_PowerPC_ppc64le_202007020835.log Mozilla-nss ppc64le build failure "fips - softokn: crypto test failed - aborting" in Factory:PowerPC caused by last sr https://build.opensuse.org/request/show/817441 in mozilla:Factory caused by last change: "add FIPS mode patches from SLE stream" extract of build log in mozilla:Factory === [ 371s] /home/abuild/rpmbuild/BUILD/nss-3.53.1/nss/cmd/shlibsign/Linux5.7_ppc_cc_glibc_PTH_64_OPT.OBJ/shlibsign -v -i /home/abuild/rpmbuild/BUILD/nss-3.53.1/nss/cmd/shlibsign/../../../dist/Linux5.7_ppc_cc_glibc_PTH_64_OPT.OBJ/lib/libsoftokn3.so [ 371s] fips - softokn: crypto test failed - aborting [ 371s] /home/abuild/rpmbuild/BUILD/nss-3.53.1/nss/cmd/shlibsign/./sign.sh: line 13: 9620 Aborted "${2}"/shlibsign -v -i "${5}" [ 371s] make[5]: *** [Makefile:92: ../../../dist/Linux5.7_ppc_cc_glibc_PTH_64_OPT.OBJ/lib/libsoftokn3.chk] Error 134 [ 371s] make[5]: Leaving directory '/home/abuild/rpmbuild/BUILD/nss-3.53.1/nss/cmd/shlibsign' [ 371s] make[4]: *** [Makefile:99: libs] Error 2 [ 371s] make[4]: Leaving directory '/home/abuild/rpmbuild/BUILD/nss-3.53.1/nss/cmd/shlibsign' [ 371s] make[3]: *** [../coreconf/rules.mk:44: shlibsign] Error 2 [ 371s] make[3]: *** Waiting for unfinished jobs.... === -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173106] zypper purge-kernels removes packages which shouldn't be removed
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173106 Frederic Crozat <fcrozat(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fcrozat(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1172924] KDE Tumbleweed image for Raspberry Pi 4B does not show login screen
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1172924 https://bugzilla.suse.com/show_bug.cgi?id=1172924#c15 --- Comment #15 from Franck Bui <fbui(a)suse.com> --- (In reply to Freek de Kruijf from comment #14) > > Should I do this? If yes, what is the upstream bug report location? https://github.com/systemd/systemd/issues -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173402] Kernel delays boot by 12s if ip= option given
by bugzilla_noreply＠suse.com 02 Jul '20

02 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173402 https://bugzilla.suse.com/show_bug.cgi?id=1173402#c3 --- Comment #3 from Fabian Vogt <fvogt(a)suse.com> --- (In reply to Thomas Blume from comment #2) > (In reply to Fabian Vogt from comment #0) > > @dracut maintainers: It seems like "rd.neednet=1" is enough to get dracut to > > acquire an address over DHCP, so a workaround is to just drop "ip=dhcp". I'd > > like to have confirmation that this is intended behaviour and won't break > > without notice in the future. This doesn't help for cases without DHCP > > though. > > Need to double check but AFAIK, rd.neednet isn't sufficient, at least if the > machine has multiple network interfaces. In this case you need to tell > dracut which interface to use. > ip=dhcp works in this case, because it is a wildcard to try all network > interfaces. Dammit. I did some more tests meanwhile and it doesn't work in some cases, presumably in those where there were no ifcfg-* files copied into the initrd. It still acquires an IP over DHCP, but the dracut initqueue times out anyway. Any idea what could be used as a workaround? -- You are receiving this mail because: You are on the CC list for the bug.

1 0