October 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1191507] VUL-0: CVE-2021-41133: flatpak: Sandbox bypass via recent VFS-manipulating syscalls
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

https://bugzilla.suse.com/show_bug.cgi?id=1191507 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://smash.suse.de/issue | |/312184/ CC| |rfrohl(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1191507] VUL-0: CVE-2021-41133: flatpak: Sandbox bypass via recent VFS-manipulating syscalls
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

https://bugzilla.suse.com/show_bug.cgi?id=1191507 SMASH SMASH <smash_bz(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |CVSSv3.1:SUSE:CVE-2021-4113 | |3:8.8:(AV:L/AC:L/PR:L/UI:N/ | |S:C/C:H/I:H/A:H) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190383] New: transactional-update fails when systemd-resolved is in use
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190383 Bug ID: 1190383 Summary: transactional-update fails when systemd-resolved is in use Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: Other Status: NEW Severity: Major Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: s(a)stuartpb.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Also reported on GitHub: https://github.com/openSUSE/transactional-update/issues/70 On my MicroOS Kubic systems running systemd-resolved, any calls to transactional-update fail, as the `/run/systemd/resolve` directory can't be copied into the snapshot: ``` # transactional-update shell Checking for newer version. transactional-update 3.5.2 started Options: shell Separate /var detected. 2021-09-09 18:09:29 tukit 3.5.2 started 2021-09-09 18:09:29 Options: -c129 open 2021-09-09 18:09:30 Using snapshot 129 as base for new snapshot 130. 2021-09-09 18:09:30 Syncing /etc of previous snapshot 128 as base into new snapshot "/.snapshots/130/snapshot" 2021-09-09 18:09:31 Discarding snapshot 130. ERROR: filesystem error: cannot copy: Operation not supported [/run/systemd/resolve] [/.snapshots/130/snapshot/run/systemd/resolve] transactional-update finished ``` Steps to reproduce: In a fresh MicroOS instance, replace wicked with systemd-resolved using a series of commands like this: ``` transactional-update shell zypper install systemd-network systemctl disable wicked.service # disable DNSSEC globally sed -i '/^#\?DNSSEC=/{s/^#//;s/=.*$/=no/}' /etc/systemd/resolved.conf systemctl enable systemd-networkd.service systemd-resolved.service ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf echo '[Match] Type=ether [Network] DHCP=yes DNSOverTLS=opportunistic [DHCPv4] UseDomains=yes RouteMetric=10 [DHCPv6] RouteMetric=10 ' > /etc/systemd/network/80-dhcp.network ``` Reboot and attempt `transactional-update shell` again. The command fails. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1191545] New: transactional-update: cannot copy: Operation not supported /run/systemd/resolve
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1191545 Bug ID: 1191545 Summary: transactional-update: cannot copy: Operation not supported /run/systemd/resolve Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: iforster(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Just noticed my rpi didn't update since July. It runs with resolved. 2021-07-07 02:00:29 tukit 3.3.0 started 2021-07-07 02:00:29 Options: -c74 open 2021-07-07 02:00:33 Using snapshot 74 as base for new snapshot 75. 2021-07-07 02:00:33 Syncing /etc of previous snapshot 73 as base into new snapshot "/.snapshots/75/snapshot" 2021-07-07 02:00:35 Discarding snapshot 75. ERROR: filesystem error: cannot copy: Operation not supported [/run/systemd/resolve] [/.snapshots/75/snapshot/run/systemd/resolve] heizung:~ # l /run/systemd/resolve/ total 8 drwxr-xr-x 2 systemd-resolve systemd-resolve 100 Oct 11 16:12 ./ drwxr-xr-x 23 root root 520 Aug 29 11:07 ../ srw-rw-rw- 1 systemd-resolve systemd-resolve 0 Aug 28 21:24 io.systemd.Resolve= -rw-r--r-- 1 systemd-resolve systemd-resolve 850 Oct 11 16:12 resolv.conf -rw-r--r-- 1 systemd-resolve systemd-resolve 920 Aug 28 21:24 stub-resolv.conf -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1181734] New: "1 Click install" adding _a_lot_ of repositories
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1181734 Bug ID: 1181734 Summary: "1 Click install" adding _a_lot_ of repositories Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: dfaggioli(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- So, maybe there is a good reason for this (in which case, sorry for the noise), but I do not understand why, when using "1 click install" from software.opensuse.org a lot of repositories are added, much more than the one(s?) needed for installing the package that one is trying to install. As an example, if I look for the "megasync" package and then follow the "1 click install" procedure, I end up with the following repos: https://download.opensuse.org/repositories/devel:/languages:/go/openSUSE_Fa… (devel:languages:go) https://download.opensuse.org/repositories/home:/Dead_Mozay/openSUSE_Tumble… (home:Dead_Mozay) https://download.opensuse.org/repositories/openSUSE:/Factory/snapshot/ (openSUSE:Factory) https://download.opensuse.org/repositories/openSUSE:/Tumbleweed/dod/ (openSUSE:Tumbleweed) https://download.opensuse.org/repositories/openSUSE:/Tumbleweed/dod_debug/ (openSUSE:Tumbleweed) https://download.opensuse.org/repositories/openSUSE:/Tumbleweed/standard/ (openSUSE:Tumbleweed) https://download.opensuse.org/repositories/utilities/openSUSE_Factory/ (utilities) They show up like this, in `zypper lr`: 5 | home_dfaggioli_branches_home_megamaced | Branch project for package rtl8821ce (openSUSE_Tumbleweed) | Yes | (r ) Yes | No 6 | https-download.opensuse.org-054a68d6 | openSUSE:Factory | Yes | (r ) Yes | Yes 7 | https-download.opensuse.org-27713afa | utilities | Yes | (r ) Yes | Yes 8 | https-download.opensuse.org-5f66b0a9 | devel:languages:go | Yes | (r ) Yes | Yes 9 | https-download.opensuse.org-7cfbaf44 | openSUSE:Tumbleweed | Yes | ( p) Yes | Yes 10 | https-download.opensuse.org-941670e8 | openSUSE:Tumbleweed | Yes | (r ) Yes | Yes 11 | https-download.opensuse.org-966896f6 | openSUSE:Tumbleweed | Yes | ( p) Yes | Yes 12 | https-download.opensuse.org-cb85059b | home:Dead_Mozay | Yes | (r ) Yes | Yes If, on the other hand, go to "Expert download" and click on "Add repository and install manually", these are the instructions: zypper addrepo https://download.opensuse.org/repositories/home:Dead_Mozay/openSUSE_Tumblew… zypper refresh zypper install megasync And, following them, the package installs and work. So, why is it that the "1 click" procedure gives me a bunch of Factory repos, that may potentially update (and even break) a lot of other packages? -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1190765] VUL-0: chromium: multiple security issues fixed in 94.0.4606.54
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

https://bugzilla.suse.com/show_bug.cgi?id=1190765 https://bugzilla.suse.com/show_bug.cgi?id=1190765#c6 --- Comment #6 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1339-1: An update that fixes 21 vulnerabilities is now available. Category: security (important) Bug References: 1190765,1191166,1191204 CVE References: CVE-2021-37956,CVE-2021-37957,CVE-2021-37958,CVE-2021-37959,CVE-2021-37960,CVE-2021-37961,CVE-2021-37962,CVE-2021-37963,CVE-2021-37964,CVE-2021-37965,CVE-2021-37966,CVE-2021-37967,CVE-2021-37968,CVE-2021-37969,CVE-2021-37970,CVE-2021-37971,CVE-2021-37972,CVE-2021-37973,CVE-2021-37974,CVE-2021-37975,CVE-2021-37976 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): chromium-94.0.4606.71-bp153.2.31.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1182144] osinfo-db: autoinst.xml does not work with Tumbleweed
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

https://bugzilla.suse.com/show_bug.cgi?id=1182144 https://bugzilla.suse.com/show_bug.cgi?id=1182144#c30 --- Comment #30 from Fabiano Fid�ncio <fabiano(a)fidencio.org> --- (In reply to Fabiano Fid�ncio from comment #29) > (In reply to Marina Latini from comment #28) > > (In reply to Marina Latini from comment #27) > > > (In reply to Fabiano Fid�ncio from comment #25) > > > > I'll open an issue upstream, try to describe what has to be done there, and > > > > if you feel like it fits your knowledge and / or you're willing to help, you > > > > can. > > > > Does this sound a fair deal? :-) > > > > > > Hello Fabiano, > > > do you have any news on this issue? > > > > > > The maintenance incident mentioned by Klaus (bsc#1182144#c16) is still > > > pending (SUSE:Maintenance:20240:244077) > > > > @Charles: > > > > as Klaus reported on comment #16 the issue is not fixed and the maintenance > > update is still pending. could you please clarify if we will get a follow-up > > submission? > > Marina, Klaus, > > I'd need someone from OpenSUSE to test the following MR (also pointed out on > comment 17): https://gitlab.com/libosinfo/osinfo-db/-/merge_requests/332 I'm looking for feedback on things like: https://gitlab.com/libosinfo/osinfo-db/-/merge_requests/332#note_700226698 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1182144] osinfo-db: autoinst.xml does not work with Tumbleweed
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

https://bugzilla.suse.com/show_bug.cgi?id=1182144 https://bugzilla.suse.com/show_bug.cgi?id=1182144#c29 --- Comment #29 from Fabiano Fid�ncio <fabiano(a)fidencio.org> --- (In reply to Marina Latini from comment #28) > (In reply to Marina Latini from comment #27) > > (In reply to Fabiano Fid�ncio from comment #25) > > > I'll open an issue upstream, try to describe what has to be done there, and > > > if you feel like it fits your knowledge and / or you're willing to help, you > > > can. > > > Does this sound a fair deal? :-) > > > > Hello Fabiano, > > do you have any news on this issue? > > > > The maintenance incident mentioned by Klaus (bsc#1182144#c16) is still > > pending (SUSE:Maintenance:20240:244077) > > @Charles: > > as Klaus reported on comment #16 the issue is not fixed and the maintenance > update is still pending. could you please clarify if we will get a follow-up > submission? Marina, Klaus, I'd need someone from OpenSUSE to test the following MR (also pointed out on comment 17): https://gitlab.com/libosinfo/osinfo-db/-/merge_requests/332 Let me know if someone can do, then we can have it merged and released. We're rolling a new release this Wednesday morning (considering CEST timezone). Best Regards, -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1191528] [Tumbleweed][Security][Pam][Build_20211008] pam-config --create failed
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1191528 http://bugzilla.opensuse.org/show_bug.cgi?id=1191528#c13 --- Comment #13 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1191528) was mentioned in https://build.opensuse.org/request/show/924639 Factory / pam-config -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190387] rpmlint: wrong warning for missing Requires
by bugzilla_noreply＠suse.com 11 Oct '21

11 Oct '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190387 http://bugzilla.opensuse.org/show_bug.cgi?id=1190387#c7 --- Comment #7 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1190387) was mentioned in https://build.opensuse.org/request/show/924629 Factory / rpmlint -- You are receiving this mail because: You are on the CC list for the bug.

1 0