September 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1175854] rsync errors out reproducibly on specific files - caused by --compress
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1175854 https://bugzilla.suse.com/show_bug.cgi?id=1175854#c13 --- Comment #13 from Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> --- What to do here? The zlib compression is broken unless we use the upstream provided library. We could keep it as is now and not rely on a new library that we will have to maintain additionally. Should we close this as won't fix? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190482] kernel BUG at mm/slub.c creates stale workers
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190482 Benjamin Greiner <code(a)bnavigator.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|code(a)bnavigator.de |screening-team-bugs(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187946] openSUSE DVD ISO upgrade - Numerous use of word "update"
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1187946 https://bugzilla.suse.com/show_bug.cgi?id=1187946#c2 Michal Filka <mfilka(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |mfilka(a)suse.com Resolution|--- |NORESPONSE --- Comment #2 from Michal Filka <mfilka(a)suse.com> --- No response for more than two months, so closing. Feel free to reopen when requested info is available. Thanks -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187416] New: php-composer needs php8-mbstring
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1187416 Bug ID: 1187416 Summary: php-composer needs php8-mbstring Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- fails otherwise -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1185376] New: VUL-0: CVE-2021-29472: php-composer: crafted URL values allow code to be executed in the HgDriver
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185376 Bug ID: 1185376 Summary: VUL-0: CVE-2021-29472: php-composer: crafted URL values allow code to be executed in the HgDriver Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/282997/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: i(a)guoyunhe.me Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-29472 Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins. The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone. Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately. Versions 1.10.22 and 2.0.13 include patches for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-29472 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29472 https://github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx https://getcomposer.org/ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1179382] mozilla-nss 3.58-1.1 breaks SSL connections in pidgin
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1179382 https://bugzilla.suse.com/show_bug.cgi?id=1179382#c10 --- Comment #10 from Swamp Workflow Management <swamp(a)suse.de> --- # maintenance_jira_update_notice openSUSE-RU-2021:3115-1: An update that has 6 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1029961,1174697,1176206,1176934,1179382,1188891 CVE References: JIRA References: Sources used: openSUSE Leap 15.3 (src): mozilla-nspr-4.32-3.20.1, mozilla-nss-3.68-3.56.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1176206] Dependency of mozilla-nss-32bit prevents installation of p11-kit-nss-trust-32bit
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1176206 https://bugzilla.suse.com/show_bug.cgi?id=1176206#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- # maintenance_jira_update_notice openSUSE-RU-2021:3115-1: An update that has 6 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1029961,1174697,1176206,1176934,1179382,1188891 CVE References: JIRA References: Sources used: openSUSE Leap 15.3 (src): mozilla-nspr-4.32-3.20.1, mozilla-nss-3.68-3.56.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1029961] [META] Finalize UsrMerge
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1029961 https://bugzilla.suse.com/show_bug.cgi?id=1029961#c113 --- Comment #113 from Swamp Workflow Management <swamp(a)suse.de> --- # maintenance_jira_update_notice openSUSE-RU-2021:3115-1: An update that has 6 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1029961,1174697,1176206,1176934,1179382,1188891 CVE References: JIRA References: Sources used: openSUSE Leap 15.3 (src): mozilla-nspr-4.32-3.20.1, mozilla-nss-3.68-3.56.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1179382] mozilla-nss 3.58-1.1 breaks SSL connections in pidgin
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1179382 https://bugzilla.suse.com/show_bug.cgi?id=1179382#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- # maintenance_jira_update_notice SUSE-RU-2021:3116-1: An update that has 6 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1029961,1174697,1176206,1176934,1179382,1188891 CVE References: JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE OpenStack Cloud Crowbar 8 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE OpenStack Cloud 9 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE OpenStack Cloud 8 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP5 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 HPE Helion Openstack 8 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1176206] Dependency of mozilla-nss-32bit prevents installation of p11-kit-nss-trust-32bit
by bugzilla_noreply＠suse.com 16 Sep '21

16 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1176206 https://bugzilla.suse.com/show_bug.cgi?id=1176206#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- # maintenance_jira_update_notice SUSE-RU-2021:3116-1: An update that has 6 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1029961,1174697,1176206,1176934,1179382,1188891 CVE References: JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE OpenStack Cloud Crowbar 8 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE OpenStack Cloud 9 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE OpenStack Cloud 8 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP5 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 HPE Helion Openstack 8 (src): mozilla-nspr-4.32-19.18.1, mozilla-nss-3.68-58.54.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0