December 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1192304] New: Device / computer name (hostname) cannot be set from GNOME Control Center, and counterintuitive to figure out in YaST
by bugzilla_noreply＠suse.com 15 Sep '22

15 Sep '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1192304 Bug ID: 1192304 Summary: Device / computer name (hostname) cannot be set from GNOME Control Center, and counterintuitive to figure out in YaST Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Minor Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: nekohayo(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I've been trying out OpenSUSE and have been quite confused by the fact that, unlike in Fedora or Debian/Ubuntu, you cannot set the computer's name from GNOME Control Center (the OS ignores/resets the changes). Figuring out how to set this up felt needlessly complicated and confusing, and I even tried searching on the web how to do it in YaST, finding vague (and misleading) third-party guides. When I see that it didn't work from GNOME Control Center, I tried setting it from the so-called "Hostnames" module in YaST, which was a bit too technical and scary for me: I'm no network admin, I know next to nothing except that if I replace "localhost" sometimes weird things can happen, so I had no idea what to do there; I tried setting the alias there. Didn't work. Then I tried replacing the "localhost" hostname value for ::1 and 127.0.0.1, and it still didn't work: GNOME Terminal, GNOME Control Center, didn't show the updated name (only localhost) and trying to ping the machine (on a local network) by its name didn't work, even after a reboot. Only by asking the hivemind on Twitter, where @antlarr pointed out that the Hostname module is not actually where you set the hostname, but rather in the "Network" module (which, upon opening, loudly complains that the system is managed by NetworkManager, and as a user you have to know to ignore that and keep digging), was I able to solve the problem: > "[...] go to System / Network Settings . Then open the Hostname/DNS tab and there you have "Static Hostname" which is what you want to change. Also, you might want to set to "no" the "Set Hostname via DHCP" option just in case." Users shouldn't have to jump through hoops of confusion to set their computer's name. Ideally, it should "just work" with GNOME Control Center, or clicking that button in GNOME Control Center should open the correct YaST module at the correct tab (but that's kind of ludicrous vs just setting it for me), and failing all that, at least the Hostnames module in YaST should empower me to do what I thought it was meant to do as a user. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1121578] New: python-aiohttp Factory version unable to build on Leap
by bugzilla_noreply＠novell.com 15 Sep '22

15 Sep '22

http://bugzilla.suse.com/show_bug.cgi?id=1121578 Bug ID: 1121578 Summary: python-aiohttp Factory version unable to build on Leap Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: mlin(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- In order to fix python-aiohttp build failure in Leap 15.1, python-aiohttp's Factory version has submitted to Leap, however this version unable to build on Leap due to missing deps, https://build.opensuse.org/package/show/openSUSE:Leap:15.1:Staging:adi:21/p… Note that, a problem is, python-Cython is one of the dep does not have greater enough version in Leap, and python-Cython is from SLE. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1181849] New: VUL-0: nim: Insecure SSL/TLS Defaults, MitM, and nimble shell command injection
by bugzilla_noreply＠suse.com 14 Sep '22

14 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1181849 Bug ID: 1181849 Summary: VUL-0: nim: Insecure SSL/TLS Defaults, MitM, and nimble shell command injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: anicka(a)suse.com Reporter: atoptsoglou(a)suse.com QA Contact: qa-bugs(a)suse.de CC: adrian.glaubitz(a)suse.com Found By: --- Blocker: --- through oss title: "Nim - Insecure SSL/TLS Defaults, MitM, and nimble shell command injection" date: 2021-02-04T14:13:23+01:00 cve: vendor: nim-lang vendorUrl: https://nim-lang.org/ authors: tintinweb affectedVersions: [ "<= 1.2.6", "nimble <=v0.12.0"] vulnClass: CWE-295, CWE-78, CWE-348 Vulnerability Note: https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaul… Vulnerability Note: https://github.com/tintinweb/pub/ Group: https://consensys.net/diligence/research/ # Vulnerability Note ## Summary We found a couple of critical security issues in the defaults for one of the standard-lib components that allows peer-impersonation (MitM) on secure transports. This also affects the languages package manager. Additionally, the package manager is vulnerable to shell command injection when fetching remote repositories before installing packages: * 2.1 - `httpClient` does no validate peer certificates by default (appears to be fixed in 1.4.x) * 2.2 - the package manager `nimble` relies on the insecure `httpClient` defaults (unfixed; latest 0.12.0 has not been re-compiled with a fixed nim-c) * 2.3 - `nimble` falls back to insecure transports if `https` is blocked (unfixed) * 2.4 - `nimble` shell command injection when fetching a package for installation (unfixed) **TLDR;** The Nim (`at least <=1.2.6`) `httpClient` default SSL/TLS configuration does not enforce peer certificate verification by default. Non-secure settings should not be the default as this might unexpectedly expose other projects to security risks. If you're using `nimble <= 0.12.0` anyone can block your TLS session and it will fall back to an insecure transport. Because of the insecure `httpClient` defaults, one can also just intercept your TLS session as the peer verification is too lax. Additionally, nimble appears to be vulnerable to a direct shell command injection when installing a package (but one can as well just provide a malicious package). ## Details see https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaul… ## Proof of Concept see https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaul… ### Timeline ``` JUL/09/2020 - contact nim developers @telegram; provided details, PoC FEB/04/2021 - deadline met. full disclosure. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1185882] New: /etc/resolv.conf not restored after NetworkManager VPN connection terminates
by bugzilla_noreply＠suse.com 14 Sep '22

14 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1185882 Bug ID: 1185882 Summary: /etc/resolv.conf not restored after NetworkManager VPN connection terminates Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: doug(a)uq.edu.au QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- For NetworkManager VPN plugins that use pppd, netconfig seems to be getting run twice (once by NetworkManager and once by pppd) resulting in /etc/resolv.conf not being restored after the VPN connection is terminated. Apparently with https://bugzilla.suse.com/show_bug.cgi?id=1079793 there was a netconfig policy change to permit non-NM settings : * Do Mai 17 2018 mt(a)suse.de - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". So changes to pppd's ip-up script and netconfig behavior can't be accepted due to that policy change as they would override the policy change behavior. More details: https://github.com/openSUSE/sysconfig/issues/31 -- You are receiving this mail because: You are on the CC list for the bug.

1 23

[Bug 1146856] New: security/fail2ban: Bug - failtoban breaks restarting firewalld
by bugzilla_noreply＠novell.com 14 Sep '22

14 Sep '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1146856 Bug ID: 1146856 Summary: security/fail2ban: Bug - failtoban breaks restarting firewalld Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: meissner(a)suse.com Reporter: Mathias.Homann(a)opensuse.org QA Contact: bnc-team-screening(a)forge.provo.novell.com Found By: --- Blocker: --- on a system with fail2ban installed and activated it is impossible to use systemctl restart to restart firewalld: nextcloud:~ # systemctl restart firewalld Failed to restart firewalld.service: Transaction contains conflicting jobs 'restart' and 'stop' for fail2ban.service. Probably contradicting requirement dependencies configured. See system logs and 'systemctl status firewalld.service' for details. the sequence "systemctl stop fail2ban; systemctl restart firewalld; systemctl start fail2ban" works as exected. the same used to happen when I still used SuSEfirewall2 instead of firewalld, so I'm pretty sure the issue is with fail2ban and not with either of the two firewalls... for more info: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871993 https://bugzilla.redhat.com/show_bug.cgi?id=1379141 https://lists.freedesktop.org/archives/systemd-devel/2016-March/036011.html -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1189045] New: windows:mingw:win{32|64}/mingw{32|64}-gcc: gdb pretty printers for libstdc++ are not installed
by bugzilla_noreply＠suse.com 13 Sep '22

13 Sep '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1189045 Bug ID: 1189045 Summary: windows:mingw:win{32|64}/mingw{32|64}-gcc: gdb pretty printers for libstdc++ are not installed Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: fstrba(a)suse.com Reporter: ralf.habacker(a)freenet.de QA Contact: screening-team-bugs(a)suse.de CC: fridrich.strba(a)bluewin.ch, hib(a)hiberis.nl, mkbosmans(a)gmail.com Found By: --- Blocker: --- The gcc sources provide gdb pretty printers for libstdc++ (see https://gcc.gnu.org/git/?p=gcc.git;a=tree;f=libstdc%2B%2B-v3/python;h=6da54…) which are not currently installed by the mingwxx-gcc package. The presence of gdb pretty printers is useful for debugging cross-compiled applications with gdb. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1183425] New: Graphical "Please enter passphrase" prompt for disk encryption upon startup is unreadable on HiDPI
by bugzilla_noreply＠suse.com 13 Sep '22

13 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1183425 Bug ID: 1183425 Summary: Graphical "Please enter passphrase" prompt for disk encryption upon startup is unreadable on HiDPI Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: gp(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 847121 --> https://bugzilla.suse.com/attachment.cgi?id=847121&action=edit Screenshot of the startup screen - the broken and too small prompt marked On a notebook with an HiDPI display the text of the prompt to enter the passphrase for the desk encryption of /home is - unreadable - horizontally(!) split in two pieces - that are distributed in the upper left and the upper right of the screen See the attached screenshot. -- You are receiving this mail because: You are on the CC list for the bug.

1 34

[Bug 1191207] New: [Build 20210929] Tracker3: no metadata available for file
by bugzilla_noreply＠suse.com 13 Sep '22

13 Sep '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1191207 Bug ID: 1191207 Summary: [Build 20210929] Tracker3: no metadata available for file Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/1948497/modules/trac ker_info/steps/7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: openQA Blocker: Yes ## Observation openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-desktopapps-other@64bit fails in [tracker_info](https://openqa.opensuse.org/tests/1948497/modules/tracker_inf… ## Test suite description Maintainer: Yuan Ren (yuanren10). See https://progress.opensuse.org/issues/23906 ## Reproducible Fails since (at least) Build [20210929](https://openqa.opensuse.org/tests/1947545) ## Expected result Last good: [20210928](https://openqa.opensuse.org/tests/1945650) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1190345] New: VUL-1: CVE-2021-21897: dfxlib: heap-based buffer overflow in the DL_Dxf:handleLWPolylineData function
by bugzilla_noreply＠suse.com 13 Sep '22

13 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1190345 Bug ID: 1190345 Summary: VUL-1: CVE-2021-21897: dfxlib: heap-based buffer overflow in the DL_Dxf:handleLWPolylineData function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/309347/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de CC: smash_bz(a)suse.de Found By: Security Response Team Blocker: --- A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21897 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21897 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1346 -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1057976] New: Patch for gtk3 (openSUSE-2017-1032) requires vietnamese, inuktitut, thai, and amharic
by bugzilla_noreply＠novell.com 12 Sep '22

12 Sep '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1057976 Bug ID: 1057976 Summary: Patch for gtk3 (openSUSE-2017-1032) requires vietnamese, inuktitut, thai, and amharic Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: x86-64 OS: openSUSE 42.2 Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)forge.provo.novell.com Reporter: Ulrich.Windl(a)rz.uni-regensburg.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 740114 --> http://bugzilla.opensuse.org/attachment.cgi?id=740114&action=edit Screen shot showing Yast's suggestions When online updating the gtk3-3.20.10-5.3.1 to gtk3-3.20.10-5.6.1, Yast2 insists to add additional language modules like gtk3-immodule-{ietnamese,inuktitut,thai,amharic} which I don't need. See attachment. -- You are receiving this mail because: You are on the CC list for the bug.

2 20