December 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1169614] AUDIT-0: cockpit: setuid, dbus, pam
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1169614 https://bugzilla.suse.com/show_bug.cgi?id=1169614#c26 --- Comment #26 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163588] New: AUDIT-FIND: chromium: chrome_sandbox shouldn't be packaged any more
by bugzilla_noreply＠novell.com 02 Dec '21

02 Dec '21

http://bugzilla.suse.com/show_bug.cgi?id=1163588 Bug ID: 1163588 Summary: AUDIT-FIND: chromium: chrome_sandbox shouldn't be packaged any more Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: tchvatal(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: --- Blocker: --- I just noticed that on openSUSE we're shipping the chromium browser still with the setuid-root sandbox in /usr/lib/chrome_sandbox. This should NOT be necessary any more, since chromium uses Linux namespaces these days for sandboxing. The chome_sandbox binary should not need to be built and shipped at all. Upstream worked for years on making this possible: https://bugs.chromium.org/p/chromium/issues/detail?id=312380 By now it is possible for a longer time already to run without this setuid-root binary. Since openSUSE kernels should all support namespaces there should be no compelling reason to keep this setuid program around. Please adjust the packaging accordingly. Afterwards the security team can remove the entry from the permissions package. Thank you. -- You are receiving this mail because: You are on the CC list for the bug.

2 13

[Bug 1157498] permissions.secure: mismatch between comment and content
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1157498 https://bugzilla.suse.com/show_bug.cgi?id=1157498#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1150366] New: AUDIT-1: ceph-common: review of setgid directory /var/log/ceph
by bugzilla_noreply＠novell.com 02 Dec '21

02 Dec '21

http://bugzilla.suse.com/show_bug.cgi?id=1150366 Bug ID: 1150366 Summary: AUDIT-1: ceph-common: review of setgid directory /var/log/ceph Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: jsegitz(a)suse.com, malte.kraus(a)suse.com, matthias.gerstner(a)suse.com, ncutler(a)suse.com Blocks: 1150189 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1150189 Like discussed in the proactive security team we want to catch up with packages installing set*id items that haven't been whitelisted yet in the permissions package. Formerly this rpmlint check type didn't cause badness and therefore didn't require packagers to actually have them reviewed. ceph-common is one of the packages installing a setgid directory that isn't currently whitelisted: /var/log/ceph drwxrws--T from ceph-common-14.2.2.354+g8878cf2360-1.1.x86_64.rpm The secure use of this directory needs to be reviewed and if all is good a whitelisting entry in all our permission profiles must be added. -- You are receiving this mail because: You are on the CC list for the bug.

2 9

[Bug 1150345] New: AUDIT-1: nagios: review of setgid directory /var/spool/nagios
by bugzilla_noreply＠novell.com 02 Dec '21

02 Dec '21

http://bugzilla.suse.com/show_bug.cgi?id=1150345 Bug ID: 1150345 Summary: AUDIT-1: nagios: review of setgid directory /var/spool/nagios Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: jsegitz(a)suse.com, malte.kraus(a)suse.com, matthias.gerstner(a)suse.com Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1150189 Like discussed in the proactive security team we want to catch up with packages installing set*id items that haven't been whitelisted yet in the permissions package. Formerly this rpmlint check type didn't cause badness and therefore didn't require packagers to actually have them reviewed. Nagios is one of the packages installing a setgid directory that isn't currently whitelisted: /var/spool/nagios drwxrwsr-x from nagios-4.4.3-3.1.i586.rpm The secure use of this directory needs to be reviewed and if all is good a whitelisting entry in all our permission profiles must be added. -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1029961] [META] Finalize UsrMerge
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1029961 https://bugzilla.suse.com/show_bug.cgi?id=1029961#c154 --- Comment #154 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1520-1: An update that solves three vulnerabilities and has 27 fixes is now available. Category: security (moderate) Bug References: 1028975,1029961,1093414,1133678,1148788,1150345,1150366,1151190,1157498,1160285,1160764,1161335,1161779,1163588,1167163,1169614,1171164,1171173,1171569,1171580,1171686,1171879,1171882,1173221,1174504,1175720,1175867,1178475,1178476,1183669 CVE References: CVE-2019-3687,CVE-2019-3688,CVE-2020-8013 JIRA References: Sources used: openSUSE Leap 15.3 (src): permissions-20200127-lp153.24.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193341] New: Blank login page.
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1193341 Bug ID: 1193341 Summary: Blank login page. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Usability Assignee: screening-team-bugs(a)suse.de Reporter: leandro.ldc345(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Blank login page. No display or backlight whatsoever. However, the computer does login when the password is typed and enter is pressed. This issue has been happening since Kernel 5.15. Specs (Laptop) Lenovo Legion Y530-15ICH: Intel Core i7-8750H NVIDIA GeForce GTX 1050Ti 1080p 60Hz IPS LCD Latest UEFI version (8JCN56WW) Latest Tumbleweed version -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1193342] Various coverity defects in multipath-tools
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1193342 http://bugzilla.opensuse.org/show_bug.cgi?id=1193342#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1193342) was mentioned in https://build.opensuse.org/request/show/935254 Factory / multipath-tools -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193338] multipathd won't start when stopped during reconfigure
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1193338 http://bugzilla.opensuse.org/show_bug.cgi?id=1193338#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1193338) was mentioned in https://build.opensuse.org/request/show/935254 Factory / multipath-tools -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193336] "systemd-udev-settle.service is deprecated. Please fix multipathd.service not to pull it in."
by bugzilla_noreply＠suse.com 02 Dec '21

02 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1193336 http://bugzilla.opensuse.org/show_bug.cgi?id=1193336#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1193336) was mentioned in https://build.opensuse.org/request/show/935254 Factory / multipath-tools -- You are receiving this mail because: You are on the CC list for the bug.

1 0