November 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1188263] New: VUL-0: CVE-2021-32746: icingaweb2: gain access to arbitrary files readable by the web-server user via the doc module
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1188263 Bug ID: 1188263 Summary: VUL-0: CVE-2021-32746: icingaweb2: gain access to arbitrary files readable by the web-server user via the doc module Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/303775/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: nix(a)opensuse.org Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-32746 Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator and users need explicit access permission to use it. Then, by visiting a certain route, it is possible to gain access to arbitrary files readable by the web-server user. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, an administrator may disable the `doc` module or revoke permission to use it from all users. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32746 https://github.com/Icinga/icingaweb2/releases/tag/v2.7.5 https://github.com/Icinga/icingaweb2/releases/tag/v2.8.3 https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32746 https://github.com/Icinga/icingaweb2/security/advisories/GHSA-cmgc-h4cx-3v43 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1190986] nouveau broken in 5.14.5-1 does not load
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1190986 https://bugzilla.suse.com/show_bug.cgi?id=1190986#c8 --- Comment #8 from Takashi Iwai <tiwai(a)suse.com> --- The best option we can take would be to report the problem to the upstream; you can report on gitlab.freedesktop.org Issues. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1188970] Xorg crashes with a segmentation fault when a secondary USB display using DisplayLink is connected
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1188970 https://bugzilla.suse.com/show_bug.cgi?id=1188970#c45 --- Comment #45 from Thomas Zimmermann <tzimmermann(a)suse.com> --- (In reply to guek wu neo from comment #40) > (In reply to guek wu neo from comment #38) > > (In reply to Takashi Iwai from comment #37) > > > Then please try the quarterly update release of SLE15-SP3. It contains the > > > recent upstream kernel in the installer, and this might have been already > > > fixed. > > > I tried 'SLE-15-SP3-Full-x86_64-QU1-Media1.iso' that is with kernel > 5.3.18=59.24-default.. but still run into the same red error prompt > 'An error occured during the installation' Can you please confirm that the kernel bug is present even with the latest installer? According to our internal logs, the kernel fix was added on Jan 12. It should have been in the installer since forever. If it still shows up, there's maybe another issue here. :/ -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1172228] New: icingaweb2 does not support PHP 7.4 of Leap 15.2
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1172228 Bug ID: 1172228 Summary: icingaweb2 does not support PHP 7.4 of Leap 15.2 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: an.alexsimon(a)googlemail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I upgraded our server to Leap 15.2. It also upgraded Icingaweb2 to 2.7.3, which does not yet support php 7.4, also the default on 15.2. Icingaweb simply pops up with a PHP error when trying to load the main page. I fixed it by switching icingaweb2 to GIT master, as suggested here: https://github.com/Icinga/icingaweb2/issues/4031 -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1188970] Xorg crashes with a segmentation fault when a secondary USB display using DisplayLink is connected
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1188970 https://bugzilla.suse.com/show_bug.cgi?id=1188970#c44 --- Comment #44 from Thomas Zimmermann <tzimmermann(a)suse.com> --- > Created attachment 851469 [details] > Xorg.0.log showing the degmentation fault. The Xorg log here is a segmentation fault in the X server AFAICT. The kernel error is not a segmentation fault. It's warning about invalid ref-counting. > [Thu Oct 14 19:12:04 2021] broken atomic modeset userspace detected, disabling atomic > [Thu Oct 14 19:12:04 2021] broken atomic modeset userspace detected, disabling atomic > [Thu Oct 14 19:12:05 2021] WARNING: CPU: 0 PID: 4219 at ../drivers/gpu/drm/drm_gem_shmem_helper.c:197 drm_gem_shmem_put_pages_locked+0x4c/0x50 [drm] I tend to think that both are unrelated. A kernel warning shouldn't crash the X server. And there are other things happening in the kernel after that warning shows up. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1188970] Xorg crashes with a segmentation fault when a secondary USB display using DisplayLink is connected
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1188970 https://bugzilla.suse.com/show_bug.cgi?id=1188970#c43 --- Comment #43 from Takashi Iwai <tiwai(a)suse.com> --- (In reply to Ricardo Lopez Caballero from comment #25) > Created attachment 853299 [details] > Supportconfig SLES15 SP2 with SP3 kernel 5.3.18.78-default > > SLES15 SP2 with SP3 kernel 5.3.18-57-default the Xorg server crashes with > segfault. Could you verify this case again but with the more recent SLE15-SP3 kernel? We'd like to confirm whether the udl segfault bug itself is relevant with the kernel error recorded in the log (which was already fixed in the recent SP3 kernel). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1188970] Xorg crashes with a segmentation fault when a secondary USB display using DisplayLink is connected
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1188970 https://bugzilla.suse.com/show_bug.cgi?id=1188970#c42 --- Comment #42 from Takashi Iwai <tiwai(a)suse.com> --- FWIW, 5.3.18-59.24-default kernel should already contain the fix mentioned in the comment 34. So it must be a different cause or still missing something else. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1192262] VUL-0: CVE-2021-41186: fluentd: ReDoS vulnerability in parser_apache2 in versions 0.14.14 to 1.14.1
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1192262 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1191556] yast inst_overview race condition?
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1191556 Jos� Iv�n L�pez Gonz�lez <jlopez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED Assignee|yast2-maintainers(a)suse.de |yast-internal(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1191556] yast inst_overview race condition?
by bugzilla_noreply＠suse.com 02 Nov '21

02 Nov '21

https://bugzilla.suse.com/show_bug.cgi?id=1191556 https://bugzilla.suse.com/show_bug.cgi?id=1191556#c4 Jos� Iv�n L�pez Gonz�lez <jlopez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jlopez(a)suse.com --- Comment #4 from Jos� Iv�n L�pez Gonz�lez <jlopez(a)suse.com> --- Ok, I will create a trello card to debug what is taking longer there. Then we can decide the solution (increasing timeout or fixing something). -- You are receiving this mail because: You are on the CC list for the bug.

1 0