September 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1190744] New: VUL-0: CVE-2021-32838: python-flask-restx: Regular expression denial of service in email_regex
by bugzilla_noreply＠suse.com 23 Sep '21

23 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190744 Bug ID: 1190744 Summary: VUL-0: CVE-2021-32838: python-flask-restx: Regular expression denial of service in email_regex Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/310440/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mimi.vx(a)gmail.com Reporter: gabriele.sonnu(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: Security Response Team Blocker: --- Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1. https://github.com/python-restx/flask-restx/issues/372 https://pypi.org/project/flask-restx/ https://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd37… https://github.com/advisories/GHSA-3q6g-vf58-7m4g https://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f… References: https://bugzilla.redhat.com/show_bug.cgi?id=2006118 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32838 https://github.com/python-restx/flask-restx/issues/372 https://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd37… https://github.com/advisories/GHSA-3q6g-vf58-7m4g https://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32838 https://pypi.org/project/flask-restx/ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1190582] tracker-extract-3 triggers sigsys in libcuda 470.57.02
by bugzilla_noreply＠suse.com 23 Sep '21

23 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190582 https://bugzilla.suse.com/show_bug.cgi?id=1190582#c3 Michael Gorse <mgorse(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mgorse(a)suse.com --- Comment #3 from Michael Gorse <mgorse(a)suse.com> --- Yeah, it's probably a libseccomp issue. I've made a test package in home:mgorse:branches:GNOME:Factory/tracker-miners with a rule added to allow that system call, but it wouldn't surprise me if it still aborts on some other call. I don't think I have hardware to test it on. This commit is supposed to prevent that library from being used by disabling the nvidia codecs in the gstreamer support: https://gitlab.gnome.org/GNOME/tracker-miners/commit/1d3accb9187611629c9be3… But factory already has it, assuming your system is up to date. So maybe it isn't enough. Having a stack trace might help. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1188238] [RPi 3 B+] bluetooth command tx timeout and reset failure
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1188238 https://bugzilla.suse.com/show_bug.cgi?id=1188238#c8 --- Comment #8 from openQA Review <openqa-review(a)suse.de> --- This is an autogenerated message for openQA integration by the openqa_review script: This bug is still referenced in a failing openQA test: jeos@RPi3 https://openqa.opensuse.org/tests/1930014 To prevent further reminder comments one of the following options should be followed: 1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted 2. The openQA job group is moved to "Released" or "EOL" (End-of-Life) 3. The bugref in the openQA scenario is removed or replaced, e.g. `label:wontfix:boo1234` -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190805] New: libyui: Broken gettext support
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190805 Bug ID: 1190805 Summary: libyui: Broken gettext support Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Keywords: I18N Severity: Major Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: sbrabec(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- I am trying to migrate old yast-translation domains to the new one for the dropped packages to the new one libyui. But devtools/build-tools/scripts/y2makepot fails with: ** ERROR: Missing textdomain in file /home/sbrabec/yast-checkout/libyui/./libyui-qt-pkg/src/YQPkgSecondaryFilterView.cc Please verify that the new package is translatable and uses valid textdomain names. Once it will be done, please let me know which code was migrated and what translations should be moved across textdomain names to prevent translation from scratch. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190096] VUL-0: chromium: update to 93.0.4577.63
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190096 https://bugzilla.suse.com/show_bug.cgi?id=1190096#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:1303-1: An update that fixes 28 vulnerabilities is now available. Category: security (important) Bug References: 1190096,1190476 CVE References: CVE-2021-30606,CVE-2021-30607,CVE-2021-30608,CVE-2021-30609,CVE-2021-30610,CVE-2021-30611,CVE-2021-30612,CVE-2021-30613,CVE-2021-30614,CVE-2021-30615,CVE-2021-30616,CVE-2021-30617,CVE-2021-30618,CVE-2021-30619,CVE-2021-30620,CVE-2021-30621,CVE-2021-30622,CVE-2021-30623,CVE-2021-30624,CVE-2021-30625,CVE-2021-30626,CVE-2021-30627,CVE-2021-30628,CVE-2021-30629,CVE-2021-30630,CVE-2021-30631,CVE-2021-30632,CVE-2021-30633 JIRA References: Sources used: openSUSE Leap 15.2 (src): chromium-93.0.4577.82-lp152.2.125.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190801] New: No sound after bootup on 15.3
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190801 Bug ID: 1190801 Summary: No sound after bootup on 15.3 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: dmarkh(a)cfl.rr.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am running a dual boot of 15.2 and 15.3 on the same hardware. That hardware is a BIOSTAR B550GTA, BIOS 5.17 04/27/2021 with a Starship/Matisse HD Audio Controller and AMD Ryzen 7 3800X 8-Core Processor. I an running the same kernel on both the 15.2 and 15.3 system and it is the current vanilla 5.10.67 kernel. On 15.2 I have sound after booting. On 15.3 I do not. And I have a red line on the KDE speaker widget on the panel. In order to get the sound working on 15.3 I have to go into Yast2/Hardware/Sound/Edit/Reset all/Yes/Next/Yes From then on sound works fine on 15.3 until a reboot happens. It's obviously not a kernel issue as I am using the very same kernel on both 15.2 and 15.3 that is built on the 15.3 system. This problem was not caused by some update because it was this way from initial install of the 15.3 system. On 15.3 #dmesg | grep codec [ 5.485748] hdaudio hdaudioC0D0: Unable to bind the codec #dmesg | grep snd shows nothing else After restarting the sound system from yast I see dmesg | grep codec [ 5.485748] hdaudio hdaudioC0D0: Unable to bind the codec [ 1613.230897] snd_hda_codec_realtek hdaudioC0D0: ALC1150: SKU not ready 0x00000000 [ 1613.231272] snd_hda_codec_realtek hdaudioC0D0: autoconfig for ALC1150: line_outs=1 (0x14/0x0/0x0/0x0/0x0) type:line [ 1613.231273] snd_hda_codec_realtek hdaudioC0D0: speaker_outs=0 (0x0/0x0/0x0/0x0/0x0) [ 1613.231274] snd_hda_codec_realtek hdaudioC0D0: hp_outs=1 (0x1b/0x0/0x0/0x0/0x0) [ 1613.231276] snd_hda_codec_realtek hdaudioC0D0: mono: mono_out=0x0 [ 1613.231276] snd_hda_codec_realtek hdaudioC0D0: dig-out=0x1e/0x0 [ 1613.231277] snd_hda_codec_realtek hdaudioC0D0: inputs: [ 1613.231278] snd_hda_codec_realtek hdaudioC0D0: Front Mic=0x19 [ 1613.231279] snd_hda_codec_realtek hdaudioC0D0: Rear Mic=0x18 [ 1613.231279] snd_hda_codec_realtek hdaudioC0D0: Line=0x1a -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1190269] VUL-0: MozillaFirefox: multiple vulnerabilities fixed in ESR 78.14, ESR 91.1, 92
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190269 https://bugzilla.suse.com/show_bug.cgi?id=1190269#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2021:3191-1: An update that fixes 14 vulnerabilities is now available. Category: security (important) Bug References: 1188891,1189547,1190269,1190274 CVE References: CVE-2021-29980,CVE-2021-29981,CVE-2021-29982,CVE-2021-29983,CVE-2021-29984,CVE-2021-29985,CVE-2021-29986,CVE-2021-29987,CVE-2021-29988,CVE-2021-29989,CVE-2021-29990,CVE-2021-29991,CVE-2021-38492,CVE-2021-38495 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE OpenStack Cloud Crowbar 8 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE OpenStack Cloud 9 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE OpenStack Cloud 8 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): MozillaFirefox-91.1.0-112.71.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE Linux Enterprise Server for SAP 12-SP3 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE Linux Enterprise Server 12-SP5 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE Linux Enterprise Server 12-SP4-LTSS (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE Linux Enterprise Server 12-SP3-LTSS (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE Linux Enterprise Server 12-SP3-BCL (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 SUSE Linux Enterprise Server 12-SP2-BCL (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 HPE Helion Openstack 8 (src): MozillaFirefox-91.1.0-112.71.1, MozillaFirefox-branding-SLE-91-35.6.6 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190799] New: Kernel-default 5.14.6 cannot be installed due to missing package suse-kernel-rpm-scriptlets
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190799 Bug ID: 1190799 Summary: Kernel-default 5.14.6 cannot be installed due to missing package suse-kernel-rpm-scriptlets Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: fkrueger(a)mailbox.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- TW20210916 with Kernel:stable enabled. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1190800] New: Missing file or link /etc/SUSE-brand in package branding-openSUSE
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190800 Bug ID: 1190800 Summary: Missing file or link /etc/SUSE-brand in package branding-openSUSE Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: aa1bb2(a)magenta.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:92.0) Gecko/20100101 Firefox/92.0 Build Identifier: There is a missing file or link in tumbleweeds package 'branding-openSUSE' which has to replace/substitute the original file /etc/SUSE-brand. The file was moved to /usr/etc/SUSE-brand in snapshot 2021-03-17. This move impacts applications that detect the OS via /etc/SUSE-brand. An example is x2goserver which now fails to launch. The package description of 'branding-openSUSE' still states it right: "This package contains the file /etc/SUSE-brand, and its name is used as a trigger..." Leap is not affected. Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190501] virt-builder fails to install packages when building an image
by bugzilla_noreply＠suse.com 22 Sep '21

22 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190501 https://bugzilla.suse.com/show_bug.cgi?id=1190501#c11 --- Comment #11 from James Fehlig <jfehlig(a)suse.com> --- (In reply to Olaf Hering from comment #10) > I guess this is something the local admin has to decide, how the kernel > inside the temporary VM should behave. 'modinfo xfs' shows the known module > options, which can be enabled via modprobe.conf files. Or tweak 'init' and > do 'modprobe xfs ; test -f /sys/module/xfs/params/param && echo value > $_' > to do it at runtime. AFAICT, the xfs module doesn't support any parms # modinfo xfs | grep parm # -- You are receiving this mail because: You are on the CC list for the bug.

1 0