December 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1178475] permissions: does not use %optflags
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1178475 https://bugzilla.suse.com/show_bug.cgi?id=1178475#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1175867] New: Security Review requested of using Xorg.wrap to start X server by default
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1175867 Bug ID: 1175867 Summary: Security Review requested of using Xorg.wrap to start X server by default Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: xiaoguang.wang(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Some time the X server need root rights to function properly, like the issue we meet in https://bugzilla.suse.com/show_bug.cgi?id=1075805. By default Xorg.wrap will auto detect if root rights are necessary, and if not it will drop its elevated rights before starting the real X server. On Fedora and Ubuntu distro they use Xorg.wrap to start X server. We hope security team can review the Xorg.wrap and we want to know whether openSUSE distro can use Xorg.wrap to start X server. -- You are receiving this mail because: You are on the CC list for the bug.

1 67

[Bug 1175720] AUDIT-0: physlock: New package physlock requires suid bit root
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1175720 https://bugzilla.suse.com/show_bug.cgi?id=1175720#c12 --- Comment #12 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174504] AUDIT-0: allow ping and ICMP commands without CAP_NET_RAW
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1174504 https://bugzilla.suse.com/show_bug.cgi?id=1174504#c33 --- Comment #33 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173221] wrong references in /etc/permissions.local
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1173221 https://bugzilla.suse.com/show_bug.cgi?id=1173221#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171882] New: mgetty: probably long dead directory /var/spool/fax/outgoing/locks in permissions profiles
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

http://bugzilla.suse.com/show_bug.cgi?id=1171882 Bug ID: 1171882 Summary: mgetty: probably long dead directory /var/spool/fax/outgoing/locks in permissions profiles Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: dmueller(a)suse.com, security-team(a)suse.de Found By: --- Blocker: --- The security team is currently sanity checking the profiles in the Base:System/permissions package. In this context we've come across the following entries related to the mgetty package: permissions.paranoid: /var/spool/fax/outgoing/locks fax:trusted 0755 permissions.easy: /var/spool/fax/outgoing/locks fax:root 0755 permissions.secure: /var/spool/fax/outgoing/locks fax:root 0755 This directory doesn't seem to be part of mgetty (sendfax) for a long time any more. Upstream commit bac8e5efeeb19ef5bef44ff1d76b73816218936b seems to have removed this in the year 2002 (upstream git repository is at git://github.greenie.net/mgetty/). If you can confirm this I'd like to remove the entries listed above from all permissions profiles. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1171879] New: screen: /var/run/uscreens conflict between systemd-tmpfiles and permissions entries
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

http://bugzilla.suse.com/show_bug.cgi?id=1171879 Bug ID: 1171879 Summary: screen: /var/run/uscreens conflict between systemd-tmpfiles and permissions entries Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mls(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: alexander_naumov(a)opensuse.org, security-team(a)suse.de Found By: --- Blocker: --- There is an ongoing effort to cleanup the entries in the permissions profiles. In this context we found out that the screen package is currently using two different mechanisms for setting the permissions of /var/run/uscreens. Original the permissions have been set via the permissions package which uses the following paths and settings in its different profiles: permissions.paranoid: /var/run/uscreens/ root:trusted 1775 permissions.paranoid: /run/uscreens/ root:trusted 1775 permissions.easy: /var/run/uscreens/ root:root 1777 permissions.easy: /run/uscreens/ root:root 1777 permissions.secure: /var/run/uscreens/ root:root 1777 permissions.secure: /run/uscreens/ root:root 1777 For a long time already screen also ships a tmpfiles.d entry which currently looks like this: $ cat /usr/lib/tmpfiles.d/screen.conf # Screen needs some files in /run: d /run/screens 0755 root root - d /run/uscreens 1777 root root - Luckily the permissions are the same for the easy and secure permissions profiles. If anybody is using the paranoid profile then `systemd-tmpfiles` and `chkstat` will fight against each other and switch the directory's mode back and forth. I suggest to rely only on the tmpfiles.d entry in the future. Therefore I'd remove the above entries from all permissions profiles. For this I'd like to get your input if this is okay for you. Furthermore you need to remove the invocations of `%set_permissions` and `%verify_permissions` from the screen package's spec file. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1171580] AUDIT-1: thttpd: permission of /usr/bin/makeweb in the secure profile
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1171580 https://bugzilla.suse.com/show_bug.cgi?id=1171580#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171569] AUDIT-1: squid: permissions and location of /usr/sbin/basic_pam_auth
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1171569 https://bugzilla.suse.com/show_bug.cgi?id=1171569#c13 --- Comment #13 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171164] AUDIT-TASK: permissions: %_libexecdir changes from /usr/lib to /usr/libexec, affects multiple entries
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1171164 https://bugzilla.suse.com/show_bug.cgi?id=1171164#c47 --- Comment #47 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0