September 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1190391] VUL-1: CVE-2021-40839: python-rencode: infinite loop in typecode decoding (such as via ;\x2f\x7f)
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190391 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190377] python2-qt5-5.15.2-lp152.183.5 seems to have gone missing
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190377 https://bugzilla.suse.com/show_bug.cgi?id=1190377#c4 --- Comment #4 from Eli Wapniarski <eliwap(a)gmail.com> --- Done. Everything seems to fine. TY :) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190377] python2-qt5-5.15.2-lp152.183.5 seems to have gone missing
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190377 https://bugzilla.suse.com/show_bug.cgi?id=1190377#c3 --- Comment #3 from Fabian Vogt <fvogt(a)suse.com> --- (In reply to Eli Wapniarski from comment #2) > Created attachment 852429 [details] > Zypper dup output > > I wouldn't call this safe :( Hm, apparently python2-qt5 depends on the private Qt API and therefore the exact same version as in Leap. Can you just uninstall python2-qt5? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190269] VUL-0: MozillaFirefox: multiple vulnerabilities fixed in ESR 78.14, ESR 91.1, 92
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

1 0

[Bug 1190269] VUL-0: MozillaFirefox: multiple vulnerabilities fixed in ESR 78.14, ESR 91.1, 92
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190269 SMASH SMASH <smash_bz(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |CVSSv3.1:SUSE:CVE-2021-3849 | |3:7.5:(AV:N/AC:H/PR:N/UI:R/ | |S:U/C:H/I:H/A:H) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190391] New: VUL-1: CVE-2021-40839: python-rencode: infinite loop in typecode decoding (such as via ;\x2f\x7f)
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190391 Bug ID: 1190391 Summary: VUL-1: CVE-2021-40839: python-rencode: infinite loop in typecode decoding (such as via ;\x2f\x7f) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/309791/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: sleep_walker(a)opensuse.org Found By: Security Response Team Blocker: --- CVE-2021-40839 The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40839 https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce01… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40839 https://github.com/aresch/rencode/pull/29 https://seclists.org/fulldisclosure/2021/Sep/16 https://pypi.org/project/rencode/#history -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1190377] python2-qt5-5.15.2-lp152.183.5 seems to have gone missing
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190377 https://bugzilla.suse.com/show_bug.cgi?id=1190377#c2 --- Comment #2 from Eli Wapniarski <eliwap(a)gmail.com> --- Created attachment 852429 --> https://bugzilla.suse.com/attachment.cgi?id=852429&action=edit Zypper dup output I wouldn't call this safe :( -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190273] Unzip thinks some files are symlinks
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1190273 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1183576] New: postfix/postmap: fatal: unsupported map type for this operation: lmdb
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1183576 Bug ID: 1183576 Summary: postfix/postmap: fatal: unsupported map type for this operation: lmdb Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: mcepl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 847271 --> https://bugzilla.suse.com/attachment.cgi?id=847271&action=edit /etc/postfix/main.cf Thank you for fixing bug 1182323, but unfortunately Postfix (postfix-3.5.9-4.1.x86_64) is still not working for me. When I run postmap, I get stitny:postfix# postmap -v sender_relayhost postmap: name_mask: all postmap: name_mask: subnet postmap: inet_addr_local: configured 4 IPv4 addresses postmap: inet_addr_local: configured 4 IPv6 addresses postmap: been_here: 127.0.0.0/8: 0 postmap: been_here: [::1]/128: 0 postmap: mynetworks_core: 127.0.0.0/8 [::1]/128 postmap: fatal: unsupported map type for this operation: lmdb stitny:postfix# cat sender_relayhost @suse.de imap.suse.de @suse.cz imap.suse.de @suse.com imap.suse.de @hotmail.com imap.suse.de @hotmail.co.uk imap.suse.de * imap.suse.de stitny:postfix# -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1189814] New: ovmf does not ignore PMBR protective record BootIndicator as required by UEFI spec
by bugzilla_noreply＠suse.com 10 Sep '21

10 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1189814 Bug ID: 1189814 Summary: ovmf does not ignore PMBR protective record BootIndicator as required by UEFI spec Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Other Assignee: virt-bugs(a)suse.de Reporter: ngompa13(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Description of problem: ovmf is taking a PMBR protective record's BootIndictor bit into account when deciding whether the GPT is valid or not. When pmbr_boot (a.k.a setting a bit on the protective record partition entry's BootIndictor in the PMBR, a.k.a. setting the boot flag, a.k.a. setting the active bit) is set, the GPT is seemingly considered invalid by ovmf and the system is not bootable. Name-Version-Release number of selected component (if applicable): ovmf-x86_64-202105-3.1 How reproducible: Always Steps to Reproduce: 1. Create a UEFI bootable image, boot it 2. parted /dev/vda disk_set pmbr_boot on 3. Try to boot the image Actual results: Firmware drops to an EFI shell. Expected results: It should boot. Additional info: Upstream bug has details including a test image attached: https://bugzilla.tianocore.org/show_bug.cgi?id=3474 There is also now an upstream commit that can be backported to fix this: https://github.com/tianocore/edk2/commit/b3db0cb1f8d163f22b769c205c6347376a… -- You are receiving this mail because: You are on the CC list for the bug.

1 10