August 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1162794] New: VUL-0: CVE-2019-10784: phpPgAdmin: improper source validation may lead to CSRF
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1162794 Bug ID: 1162794 Summary: VUL-0: CVE-2019-10784: phpPgAdmin: improper source validation may lead to CSRF Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/252397/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-10784 phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit a malicious page with a CSRF exploit and execute arbitrary system commands on the server. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10784 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10784 https://snyk.io/vuln/SNYK-PHP-PHPPGADMINPHPPGADMIN-543885 -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1036463] New: Please take over /usr/lib/modules-load.d/sg.conf
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1036463 Bug ID: 1036463 Summary: Please take over /usr/lib/modules-load.d/sg.conf Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi kernel maintainers, Currently systemd package ships the following file: $ cat /usr/lib/modules-load.d/sg.conf # load sg module at boot time sg I don't know if it's still needed but if so it doesn't seem appropriate to ship it through systemd since it seems to be a workaround for a missing driver dependency or something similar. Would you take this file over ? Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

2 94

[Bug 1133418] New: sg3_utils: syntax error in 59-fc-wwpn-id.rules
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1133418 Bug ID: 1133418 Summary: sg3_utils: syntax error in 59-fc-wwpn-id.rules Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.wilck(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- [ 74.262834] systemd-udevd[2958]: /usr/lib/udev/rules.d/59-fc-wwpn-id.rules:12: Invalid key/value pair, starting at character 25 (';') -- You are receiving this mail because: You are on the CC list for the bug.

2 17

[Bug 1133122] New: LTO: cmocka build fails
by bugzilla_noreply＠novell.com 12 Jul '22

12 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1133122 Bug ID: 1133122 Summary: LTO: cmocka build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails with: [ 64s] [ LINE ] --- /home/abuild/rpmbuild/BUILD/cmocka-1.1.1/tests/test_group_setup_assert.c:13: error: Failure! It's due to a known issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88643 -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1127690] New: haveged: Couldn't initialize HAVEGE rng 9
by bugzilla_noreply＠novell.com 12 Jul '22

12 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1127690 Bug ID: 1127690 Summary: haveged: Couldn't initialize HAVEGE rng 9 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: aarch64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: ro(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- haveged can not be started on the mustang boards when running leap 51.1 adding the "--data 16" option as workaround allows starting the daemon, please see also: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866306 -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1141928] New: python-acme will break on November 1st
by bugzilla_noreply＠novell.com 11 Jul '22

11 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1141928 Bug ID: 1141928 Summary: python-acme will break on November 1st Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: bmw(a)eff.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This bug affects the python*-acme packages in Leap 15.0 and 15.1. If there is already a version of python*-acme frozen in Leap 15.2, it is affected if it is not version 0.34.0 or greater. The python*-acme packages will no longer work with Let’s Encrypt’s “ACMEv2” endpoint which is their RFC 8555 compliant endpoint starting November 1st. See https://community.letsencrypt.org/t/acme-v2-scheduled-deprecation-of-unauth… for more details about this change. As one of the upstream maintainers of this library, I would recommend backporting python-acme 0.34.0 or greater to all supported versions of openSUSE. There are no breaking changes to the Python API and no dependencies should have to be updated. If you do this, to flag a couple changes for you that you may want to know about: * Some of the code in the library has been deprecated in recent versions and while it still works just fine it is causing Python DeprecationWarnings. See https://docs.python.org/3/library/warnings.html if you're not familiar with this. * There is an extremely minor change in the requests sent by the library. The previous versions were not RFC 8555 compliant and there are no known ACME CAs that rely on this non-standard behavior, but it's something you may want to know about. More details about this change are at https://github.com/certbot/certbot/pull/6975. If either of these changes are especially worrisome to you, I could tell you the changes that need to be backported to an earlier version of python-acme, however, I do not recommend this as it will result packages that have been less thoroughly tested. -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1119619] New: certbot does not renew certificates (again)
by bugzilla_noreply＠novell.com 11 Jul '22

11 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1119619 Bug ID: 1119619 Summary: certbot does not renew certificates (again) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jimc(a)math.ucla.edu QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Formerly I had python-certbot-0.26.1-1.1.noarch and it could renew certs. Now I have python3-certbot-0.28.0-2.1.noarch on OpenSuSE Tumbleweed VERSION="20181208" This is the one with the dependency on python-mock restored/added. It says "No renewals were attempted" on both of my hosts that use certbot. I tracked this down to a (non) migration issue: formerly the state dir was /etc/certbot but now it is /etc/letsencrypt, which of course contains no lineages, so no renewals were attempted. Workaround: mv /etc/letsencrypt /etc/letsencrypt.empty mv /etc/certbot /etc/letsencrypt ln -s letsencrypt certbot The symlink is so explicit filenames in config files, or symlinks in e.g. /etc/openssl/private, will still find the cert and key until I locate and fix them. Tested: my Apache webserver still can authenticate using the (not quite expired) old cert. I ran "certbot renew", its webroot challenges were acceptable (despite some DNAT stuff), and the report was: Congratulations, all renewals succeeded... (list of 1 renewed cert). Testing: the webserver successfully uses the new cert. By the way, old logs are in /var/log/certbot which is still there but is supplanted by /var/log/letsencrypt. It would be nice if the python3-certbot and python2-certbot packages had a migration script for users who are having trouble figuring out why their certs are not being renewed. I'm not sure whether migration scripts in packages should be reported upstream, or to the distro; if the former, let me know and I'll open a ticket upstream. Also I set the component to "security" since the X.509 certificate's purpose is security, but if a different component would be more appropriate please feel free to change it. -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1149986] New: telegram-desktop cannot be started with enabled GTK integration and libqt5-qtstyleplugins-platformtheme-gtk2 installed
by bugzilla_noreply＠novell.com 10 Jul '22

10 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1149986 Bug ID: 1149986 Summary: telegram-desktop cannot be started with enabled GTK integration and libqt5-qtstyleplugins-platformtheme-gtk2 installed Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: tux93(a)opensuse.org Reporter: tux93(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Trying to start telegram-desktop built with enabled GTK integration and libqt5-qtstyleplugins-platformtheme-gtk2 installed fails with > ~>telegram-desktop > (telegram-desktop:4205): GLib-GObject-WARNING **: 17:15:44.346: cannot register existing type 'GdkDisplayManager' > (telegram-desktop:4205): GLib-CRITICAL **: 17:15:44.346: g_once_init_leave: assertion 'result != 0' failed > (telegram-desktop:4205): GLib-GObject-CRITICAL **: 17:15:44.346: g_object_new_with_properties: assertion 'G_TYPE_IS_OBJECT (object_type)' failed Currently this is resolved by a conflict of telegram-desktop with libqt5-qtstyleplugins-platformtheme-gtk2 which leads to cunfusion of users (bug 1148509) Ideally the root cause should be found and patched. A package without the conflict for testing can be found at https://build.opensuse.org/project/show/home:tux93:tdesktop-no-conflict -- You are receiving this mail because: You are on the CC list for the bug.

2 33

[Bug 1110456] New: rsyslog not logging most messages
by bugzilla_noreply＠novell.com 07 Jul '22

07 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1110456 Bug ID: 1110456 Summary: rsyslog not logging most messages Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kubic Assignee: kubic-bugs(a)opensuse.org Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- On SLES, all messages I see in journalctl are also available in /var/log/messages. On Kubic, where we use rsyslog, nearly no message I see in journalctl can be found in /var/log/messages. So something with journalctl and rsyslog is configured wrong. -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1068678] New: Package rsyslog requires package system-user-news
by bugzilla_noreply＠novell.com 07 Jul '22

07 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1068678 Bug ID: 1068678 Summary: Package rsyslog requires package system-user-news Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: freek(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When installing rsyslog in Tumbleweed there are warning messages that the user news is not present (chown: invalid user: 'news:news'). Unless rsyslog is changed to not using news, the package should require the package "system-user-news". -- You are receiving this mail because: You are on the CC list for the bug.

2 2