December 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1192970] Can't establish WIFI WPA3 connection with NetworkManager in KDE
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1192970 https://bugzilla.suse.com/show_bug.cgi?id=1192970#c13 --- Comment #13 from �� <s.pooheer(a)gmail.com> --- ctrl_interface=DIR=/var/run/wpa_supplicant network={ ssid="linux" key_mgmt=SAE psk="***" } -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1192970] Can't establish WIFI WPA3 connection with NetworkManager in KDE
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1192970 https://bugzilla.suse.com/show_bug.cgi?id=1192970#c12 --- Comment #12 from �� <s.pooheer(a)gmail.com> --- Created attachment 854204 --> https://bugzilla.suse.com/attachment.cgi?id=854204&action=edit nmcli connection show -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193273] VUL-1: CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1193273 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193273] New: VUL-1: CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1193273 Bug ID: 1193273 Summary: VUL-1: CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/315195/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2024938 n the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby (Docker Engine) prior to 20.10.11 treat the Content-Type header as trusted and deserialize the document according to that header. If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image. References: https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42 https://github.com/opencontainers/distribution-spec/security/advisories/GHS… https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-… https://github.com/containerd/containerd/releases/tag/v1.4.12 https://github.com/containerd/containerd/releases/tag/v1.5.8 https://github.com/moby/moby/releases/tag/v20.10.11 References: https://bugzilla.redhat.com/show_bug.cgi?id=2024938 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41190 http://seclists.org/oss-sec/2021/q4/123 https://github.com/opencontainers/distribution-spec/security/advisories/GHS… https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd30… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41190 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41190 https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1192970] Can't establish WIFI WPA3 connection with NetworkManager in KDE
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1192970 https://bugzilla.suse.com/show_bug.cgi?id=1192970#c11 --- Comment #11 from Jonathan Kang <songchuan.kang(a)suse.com> --- (In reply to �� from comment #10) > # iw phy0 info|grep -A9 'Supported Ciphers' > Supported Ciphers: > * WEP40 (00-0f-ac:1) > * WEP104 (00-0f-ac:5) > * TKIP (00-0f-ac:2) > * CCMP-128 (00-0f-ac:4) > * CCMP-256 (00-0f-ac:10) > * GCMP-128 (00-0f-ac:8) > * GCMP-256 (00-0f-ac:9) > Available Antennas: TX 0 RX 0 > Supported interface modes: > x201:/etc/NetworkManager # nmcli connection modify linux wifi-sec.pmf disable > > Workaround didn't helps, no connection with WPA3 in NM-applet Can you attach the output of "nmcli connection show $connection-name" and your wpa_supplicant configuration file that you used to connect to WPA3 wifi directly? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193172] systemd[1]: klog.service: Failed with result 'exit-code'.
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1193172 https://bugzilla.suse.com/show_bug.cgi?id=1193172#c15 --- Comment #15 from Dr. Werner Fink <werner(a)suse.com> --- For ProtectHome=true ... maybe a grep :/var/log /etc/passwd shows if there is a HOME below /var/log ... like lirc -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193172] systemd[1]: klog.service: Failed with result 'exit-code'.
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1193172 https://bugzilla.suse.com/show_bug.cgi?id=1193172#c14 --- Comment #14 from Johannes Segitz <jsegitz(a)suse.com> --- Something must be wrong apart from the hardenings. It doesn't make sense that this service fails if just ProtectHome is set. ExecStart=/bin/sh -c "test -s /var/log/boot.msg && /bin/mv -f /var/log/boot.msg /var/log/boot.omsg || :" ExecStart=/bin/sh -c "/bin/dmesg -r > /var/log/boot.msg" ExecStart=/bin/sh -c "test -s /dev/shm/initrd.msg && /bin/cat /dev/shm/initrd.msg >> /var/log/boot.msg || :" ExecStart=/bin/sh -c "test -c /dev/tty$KLOG_CONSOLE && /usr/bin/setlogcons $KLOG_CONSOLE || :" ExecStart=/bin/sh -c "if test -n \"$CONSOLE_LOGLEVEL\" ; then /bin/dmesg -n $CONSOLE_LOGLEVEL || : ; fi" nothing here accesses the home directories. For me doing a daemon-reload wasn't enough to test this. I had to reboot the machine to get to a proper state. I have the service running with ProtectSystem=full ProtectHome=true ProtectHostname=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true RestrictRealtime=true enabled. As this is a one-shot service I don't mind if we remove those hardenings for this service, but it is quite strange. Can someone who has the problem please remove all but the ProtectHome hardenings, reboot and verify that it still fails, then comment out the ExecStart commands one by one (rebooting each time) to see if we can find the command that trips? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1192970] Can't establish WIFI WPA3 connection with NetworkManager in KDE
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1192970 https://bugzilla.suse.com/show_bug.cgi?id=1192970#c10 --- Comment #10 from �� <s.pooheer(a)gmail.com> --- # iw phy0 info|grep -A9 'Supported Ciphers' Supported Ciphers: * WEP40 (00-0f-ac:1) * WEP104 (00-0f-ac:5) * TKIP (00-0f-ac:2) * CCMP-128 (00-0f-ac:4) * CCMP-256 (00-0f-ac:10) * GCMP-128 (00-0f-ac:8) * GCMP-256 (00-0f-ac:9) Available Antennas: TX 0 RX 0 Supported interface modes: x201:/etc/NetworkManager # nmcli connection modify linux wifi-sec.pmf disable Workaround didn't helps, no connection with WPA3 in NM-applet -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193172] systemd[1]: klog.service: Failed with result 'exit-code'.
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1193172 https://bugzilla.suse.com/show_bug.cgi?id=1193172#c13 --- Comment #13 from Dr. Werner Fink <werner(a)suse.com> --- Yep there is a reason why klog.service is a oneshot as well it refuses to be started manually (means via e.g. systemctl) as otherwise it would trash/smash the /var/log/boot.msg as well as /var/log/boot.omsg And klog.service should be able to access the character devices below /dev as otherwise /usr/bin/setlogcons as well as /bin/dmesg can not work ... also boot.msg and boot.omsg should be in the real upper filesystem and not within a temporary userspace -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1192970] Can't establish WIFI WPA3 connection with NetworkManager in KDE
by bugzilla_noreply＠suse.com 01 Dec '21

01 Dec '21

https://bugzilla.suse.com/show_bug.cgi?id=1192970 https://bugzilla.suse.com/show_bug.cgi?id=1192970#c9 --- Comment #9 from Jonathan Kang <songchuan.kang(a)suse.com> --- > 1638268502.092199: nl80211: kernel reports: key setting validation failed > 1638268502.092251: nl80211: set_key failed; err=-22 Invalid argument) > 1638268502.092279: wlan0: WPA: Failed to configure IGTK to the driver > 1638268502.092304: wlan0: RSN: Failed to configure IGTK > NetworkManager[5489]: <info> [1638179804.7540] Config: added 'ieee80211w' value '2' It seems that your wireless card doesn't support PMF. And NetworkManager set it to required somehow. You can check whether it has the support by checking if at least CMAC or GMAC is available in the output of: > iw phy0 info | grep -A9 'Supported Ciphers' Can you try whether this can work around the issue? > nmcli connection modify <connection> wifi-sec.pmf disable -- You are receiving this mail because: You are on the CC list for the bug.

1 0