May 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1185774] New: VUL-0: CVE-2021-32062: mapserver: flaw in CGI mapfile loading that makes it possible to bypass security controls
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185774 Bug ID: 1185774 Summary: VUL-0: CVE-2021-32062: mapserver: flaw in CGI mapfile loading that makes it possible to bypass security controls Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/283589/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: dassau(a)gbd-consult.de Reporter: gianluca.gabrielli(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-32062 MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI). References: https://mapserver.org/development/changelog/changelog-7-6.html https://mapserver.org/development/changelog/changelog-7-0.html https://mapserver.org/development/changelog/changelog-7-4.html https://mapserver.org/development/changelog/changelog-7-2.html References: https://bugzilla.redhat.com/show_bug.cgi?id=1957872 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32062 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32062 https://mapserver.org/development/changelog/changelog-7-2.html https://mapserver.org/development/changelog/changelog-7-0.html https://mapserver.org/development/changelog/changelog-7-6.html https://mapserver.org/development/changelog/changelog-7-4.html -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1184581] Live medium should have a version number
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1184581 https://bugzilla.suse.com/show_bug.cgi?id=1184581#c4 David Cassany <dcassany(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FEATURE --- Comment #4 from David Cassany <dcassany(a)suse.com> --- > Appears to work here, but the build fails because the string gets too long... > > There appears to be more space in the "Application id", can that be filled? Currently not, this is not customizable and it is being actually used to store the MBR ID, not sure why, probably only for debugging purposes. In any case I'd say the suggestion from #c2 is valid, so basically the missing part is having additional metadata fields available for customization on KIWI so we are not strictly limited to the 32 characters. I am closing this issue as I understand there is no bug to fix here and that a constrained to 32 characters solution is already possible. I opened this upstream issue to include further metadata options to live images: https://github.com/OSInside/kiwi/issues/1810 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185764] hdmi alsa "Total latency of output is very high"
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185764 http://bugzilla.opensuse.org/show_bug.cgi?id=1185764#c5 --- Comment #5 from Diego Ercolani <diego.ercolani(a)gmail.com> --- I tried, I have the same delay of 2 seconds so it seem not a snd-usb-audio issue, by the way I leave it blacklisted for now. The problem seem more related to pulseaudio as If I use a pactl exit then sometimes it seem to zero the delay (temporarly). The problem is that if it happens while I'm on a conference call I'm kicked out and I have to reconnect... very annoying -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185769] New: Module kheaders not available
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185769 Bug ID: 1185769 Summary: Module kheaders not available Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: aloisio(a)gmx.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I have a tool (procmon) that depends on it to work. Would it be possible to enable kheaders, even shipping it separately if too bulky? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185764] hdmi alsa "Total latency of output is very high"
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185764 http://bugzilla.opensuse.org/show_bug.cgi?id=1185764#c4 --- Comment #4 from Takashi Iwai <tiwai(a)suse.com> --- That's quite possible. Could you try to unload / blacklist snd-usb-audio module and check whether the problem is gone? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185764] hdmi alsa "Total latency of output is very high"
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185764 http://bugzilla.opensuse.org/show_bug.cgi?id=1185764#c3 --- Comment #3 from Diego Ercolani <diego.ercolani(a)gmail.com> --- Created attachment 849150 --> http://bugzilla.opensuse.org/attachment.cgi?id=849150&action=edit Alsa Info 2 other �: 1. with the default kernel all the log lines complaining about latency disappeared and the delay seems tied to ~2sec 2. I think is something related to usb timing, I think the ARC camera is doing something nasty to usb bus and snd-usb module is it possible? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1184808] AUDIT-0: Shipping keys via repos
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1184808 https://bugzilla.suse.com/show_bug.cgi?id=1184808#c26 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #26 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- The review aspect for this is complete I guess. Regarding documentation we approach our documentation team to make them aware and to see whether they can improve something here. Closing. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1184808] AUDIT-0: Shipping keys via repos
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1184808 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|1184326 | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1184326] zypper dup from Leap 15.2 to 15.3 beta: rpm verification keys not installed, rpms installed unverified
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1184326 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|1184808 | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185440] FTBFS: openSUSE:Factory/yast2-rmt fails to build
by bugzilla_noreply＠suse.com 07 May '21

07 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1185440 https://bugzilla.suse.com/show_bug.cgi?id=1185440#c2 Dominique Leuenberger <dleuenberger(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |dleuenberger(a)suse.com Resolution|--- |FIXED --- Comment #2 from Dominique Leuenberger <dleuenberger(a)suse.com> --- (In reply to Thomas Schmidt from comment #1) > Updated package is accepted in Factory: > https://build.opensuse.org/request/show/891048 > Can we close this? That seems ok Next up should be to get rmt-server back in shape (but that's a different bug, to be created) -- You are receiving this mail because: You are on the CC list for the bug.

1 0