August 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1139983] New: MOTD/Banner displays incorrect temporary ipv6 address
by bugzilla_noreply＠novell.com 21 Mar '22

21 Mar '22

http://bugzilla.suse.com/show_bug.cgi?id=1139983 Bug ID: 1139983 Summary: MOTD/Banner displays incorrect temporary ipv6 address Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kubic Assignee: kubic-bugs(a)opensuse.org Reporter: william.brown(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Welcome to openSUSE MicroOS (x86_64) - Kernel 5.1.10-1-default (ttyS0). SSH host key: SHA256:6QuFaJra32Q8YuDkPOAvBPuacPy/LTCfsXHyJyylX8c (RSA) SSH host key: SHA256:4k9o1M7R+Udl45mZ22fbh8zE8V4Euldaa+zwW6OpTC8 (DSA) SSH host key: SHA256:owuHie1/KxmL5AakWgsUCnMFUTZWbg5FUeuZmCgZ6oo (ECDSA) SSH host key: SHA256:f/etHr1/kSajCkJJifh+tfD0M+txifFYTIy9yJDGOLc (ED25519) ens3: 172.24.15.18 2001:44b8:2155:2c15:b920:673c:ab7a:e897 linux-om6d login: root Password: linux-om6d:~ # ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 52:54:00:12:22:b9 brd ff:ff:ff:ff:ff:ff inet 172.24.15.18/24 brd 172.24.15.255 scope global ens3 valid_lft forever preferred_lft forever inet6 2001:44b8:2155:2c15:b920:673c:ab7a:e897/64 scope global temporary dynamic valid_lft 86366sec preferred_lft 14366sec inet6 2001:44b8:2155:2c15:5054:ff:fe12:22b9/64 scope global dynamic mngtmpaddr valid_lft 86366sec preferred_lft 14366sec inet6 fe80::5054:ff:fe12:22b9/64 scope link valid_lft forever preferred_lft forever Note that the banner is displaying the global temporary address, rather than the dynamic mngtm address which is fixed. This means that if someone was to copy-paste from the banner to their DNS they would be registering an ephemeral address rather than the correct one. -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1099563] New: Texlive/XeTeX crashes when processing specific PNGs
by bugzilla_noreply＠novell.com 17 Mar '22

17 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1099563 Bug ID: 1099563 Summary: Texlive/XeTeX crashes when processing specific PNGs Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: stefan.bruens(a)rwth-aachen.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- XeTex crashes or embeds random data due to out-of-bounds accesses when processing PNG images with no more than 16 colors and transparency (1/2/4 bit palette). This has been reported as upstream issue #151, https://sourceforge.net/p/xetex/bugs/151/ The bug is fixed in TL 2018. This causes e.g. building of the latest KICAD documentation to fail. Fixed version is available here: https://build.opensuse.org/package/show/home:StefanBruens:branches:SUSE:SLE… -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1167516] New: VUL-0: CVE-2020-9759: weechat: a malformed message 352 (who) can cause a NULL pointer dereference
by bugzilla_noreply＠novell.com 14 Mar '22

14 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1167516 Bug ID: 1167516 Summary: VUL-0: CVE-2020-9759: weechat: a malformed message 352 (who) can cause a NULL pointer dereference Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/255640/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: mimi.vx(a)gmail.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-9759 An issue was discovered in WeeChat before 2.7.1 (0.4.0 to 2.7 are affected). A malformed message 352 (who) can cause a NULL pointer dereference in the callback function, resulting in a crash. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9759 https://github.com/weechat/weechat/commit/9904cb6d2eb40f679d8ff6557c22d53a3… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9759 https://weechat.org/doc/security/ -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1167514] New: VUL-1: CVE-2020-9760: weechat: When a new IRC message 005 is received with longer nick prefixes a buffer overflow can happen
by bugzilla_noreply＠novell.com 14 Mar '22

14 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1167514 Bug ID: 1167514 Summary: VUL-1: CVE-2020-9760: weechat: When a new IRC message 005 is received with longer nick prefixes a buffer overflow can happen Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/255641/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: mimi.vx(a)gmail.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-9760 An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9760 https://github.com/weechat/weechat/commit/40ccacb4330a64802b1f1e28ed9a6b6d3… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9760 https://weechat.org/doc/security/ -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1163889] New: VUL-0: CVE-2020-8955: weechat: denial of service in irc_mode_channel_update in plugins/irc/irc-mode.c
by bugzilla_noreply＠novell.com 14 Mar '22

14 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1163889 Bug ID: 1163889 Summary: VUL-0: CVE-2020-8955: weechat: denial of service in irc_mode_channel_update in plugins/irc/irc-mode.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/253020/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: tchvatal(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#1803064 A vulnerability was found in irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode). Reference: https://github.com/weechat/weechat/commit/6f4f147d8e86adf9ad34a8ffd7e7f1f23… https://weechat.org/doc/security/ References: https://bugzilla.redhat.com/show_bug.cgi?id=1803064 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8955 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-8955.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8955 https://github.com/weechat/weechat/commit/6f4f147d8e86adf9ad34a8ffd7e7f1f23… https://weechat.org/doc/security/ -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1172415] New: The eekboard layout does not have the eleventh consonant "ट" in Inscript Hindi.
by bugzilla_noreply＠suse.com 14 Mar '22

14 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1172415 Bug ID: 1172415 Summary: The eekboard layout does not have the eleventh consonant "ट" in Inscript Hindi. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: prakashchitnis(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I run Leap 15.1 on my desktop. I use eekboard software to type in Hindi and Marathi languages using the "Inscript" keyboard layout. I could not find the eleventh consonant that is "ट" in Devnagri script on the keyboard. It should have appeared at the spot the single quotation mark is put on the onscreen keyboard (same as in US keyboard layout). The same "Inscript" is used even in Windows (I may say universally) and this consonant is there. The official site for "Inscript" also is fine. The problem, I presume, is in the file used by eekboard. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 924591] New: Apache2 doesn't start with faulty config, prob from yast
by bugzilla_noreply＠novell.com 14 Mar '22

14 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=924591 Bug ID: 924591 Summary: Apache2 doesn't start with faulty config, prob from yast Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: armv7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: volker3204(a)paradise.net.nz QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Running yast http-server module, making basically no changes to get basic config. No vhosts, ssl, etc. Btw a server name can't be entered, the value is going to /dev/null. Starting apache gives: Mar 27 14:37:35 cubie start_apache2[9361]: Module "authz_default" is not installed, ignoring. Mar 27 14:37:35 cubie start_apache2[9361]: Check the APACHE_MODULES setting in /etc/sysconfig/apache2. Mar 27 14:37:35 cubie start_apache2[9361]: AH00526: Syntax error on line 10 of /etc/apache2/mod_status.conf: Mar 27 14:37:35 cubie start_apache2[9361]: Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration Mar 27 14:37:36 cubie start_apache2[9378]: Module "authz_default" is not installed, ignoring. Mar 27 14:37:36 cubie start_apache2[9378]: Check the APACHE_MODULES setting in /etc/sysconfig/apache2. Mar 27 14:37:36 cubie start_apache2[9378]: AH00526: Syntax error on line 10 of /etc/apache2/mod_status.conf: Mar 27 14:37:36 cubie start_apache2[9378]: Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration Mar 27 14:37:36 cubie systemd[1]: Failed to start The Apache Webserver. In the yast http-server server-modules tab authz_default is listed with a description of "unknown", i.e. none. The module does not exist on disk! Editing /etc/sysconfig/apache2 adding authz_core to APACHE_MODULES makes authz_core also be shown with a description of "unknown". systemctl restart apache2 is now successful. This bnc:835484#6 basically says yast http-server module is foobared, so it's probably best to uninstall it. -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 918705] New: alpine locking failure (against procmail) leads to mail corruption
by bugzilla_noreply＠novell.com 11 Mar '22

11 Mar '22

http://bugzilla.suse.com/show_bug.cgi?id=918705 Bug ID: 918705 Summary: alpine locking failure (against procmail) leads to mail corruption Classification: openSUSE Product: openSUSE Factory Version: 201502* Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: gp(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is something I started to see a bit ago, and since it now happened twice today I figured I'd report it. When I obtain mail via fetchmail, using procmail as the delivery agent, occasionally I get corrupted mails like the following (in mbox format): ==== snip ==== >From gp Thu Feb 19 18:56:54 2015 Mime-Version: 1.0 Date: Thu, 19 Feb 2015 18:56:00 +0100 Subject: AW: Re: Your help needed: Fwd: Comment opportunity: Software Status: RO X-Status: X-Keywords: X-UID: 9310 definedstorage Subject: AW: Re: Your help needed: Fwd: Comment opportunity: Software definedstorage References: <54E302D90200006F00158C8B(a)suse.com> <54E2D72A0200002B000A1B55(a)suse.com> <54E339FA0200006F00158DBD(a)suse.com> <54E2D7DE0200002B000A1B68(a)suse.com> <alpine.LSU.2.11.1502191739290.2252(a)ghan.fvgr> In-Reply-To: <alpine.LSU.2.11.1502191739290.2252(a)ghan.fvgr> Message-ID: <54E623B70200006F001594A6(a)suse.com> From: ... To: "Gerald Pfeifer" <gp(a)suse.com> ==== snap ==== This does not happen daily, and I believe it happens especially when I have been offline for several hours and a few dozen e-mails are delivered at once (though this specific case was not that). The same configuration had been working for years without ever showing this problem, and it looks like looking on the Alpine side (or procmail, though less likely I guess, since it essentially only reads :0 INBOX ) -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1102075] New: [Build 20180719] openQA test fails in rails
by bugzilla_noreply＠novell.com 10 Mar '22

10 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1102075 Bug ID: 1102075 Summary: [Build 20180719] openQA test fails in rails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/709954/modules/rails /steps/12 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Ruby Assignee: ruby-devel(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- ## Observation openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-extra_tests_in_textmode@64bit fails in [rails](https://openqa.opensuse.org/tests/709954/modules/rails/steps/12) ## Reproducible Fails since (at least) Build [20180714](https://openqa.opensuse.org/tests/708132) ## Expected result Last good: [20180714](https://openqa.opensuse.org/tests/707517) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&version=Tumble… The rails stack is (once again) broken: the sqlite3 module seems not to be present after executing the test. the test-code does: > zypper -n in -C "rubygem(rails)" > rails new mycoolapp --skip-bundle --skip-test > cd mycoolapp > (rails server -b 0.0.0.0 &) -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1172267] New: OpenSSL 3.0.0 upgrade tracker bug
by bugzilla_noreply＠suse.com 09 Mar '22

09 Mar '22

http://bugzilla.suse.com/show_bug.cgi?id=1172267 Bug ID: 1172267 Summary: OpenSSL 3.0.0 upgrade tracker bug Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: vcizek(a)suse.com Reporter: vcizek(a)suse.com QA Contact: qa-bugs(a)suse.de CC: jsikes(a)suse.com, meissner(a)suse.com, pmonrealgonzalez(a)suse.com Found By: --- Blocker: --- This bug collects the challenges and packages that need to be adapted for OpenSSL 3.0.0 upgrade. Major changes in 3.0.0: * OpenSSL 3.0 is a major release and consequently any application that currently uses an older version of OpenSSL will at the very least need to be recompiled in order to work with the new version. * The OpenSSL versioning scheme has changed with the 3.0 release to format: MAJOR.MINOR.PATCH The patch level is indicated by the third number instead of a letter * Providers and FIPS support Providers collect together and make available algorithm implementations. * Use of the low level APIs have been deprecated. * Some cryptographic algorithms that were available via the EVP APIs are now considered legacy and their use is strongly discouraged. * Engines and "METHOD" APIs are deprecated and shall be transformed to providers Detailed list of changes since 1.1.1: https://www.openssl.org/news/changelog.html#openssl-30 The final release is planned for 2020 early Q4. https://www.openssl.org/policies/releasestrat.html OpenSSL 3.0.0 wiki: https://wiki.openssl.org/index.php/OpenSSL_3.0 Design changes in 3.0.0: https://www.openssl.org/docs/OpenSSL300Design.html -- You are receiving this mail because: You are on the CC list for the bug.

1 12