September 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1185637] New: openssl-1_1 fails to build after 2022-06-01
by bugzilla_noreply＠suse.com 06 Jul '22

06 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1185637 Bug ID: 1185637 Summary: openssl-1_1 fails to build after 2022-06-01 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: pmonrealgonzalez(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: jsikes(a)suse.com Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our openssl-1_1/openssl-1.1.1k fails tests after 2022-06-01 Likely reason is one or more of these expiring certs: for cert in `find test -name \*pem` ; do openssl x509 -text < $cert | grep After |grep 2022 && echo $cert ; done 2>&1 |grep -A1 2022 Not After : Apr 13 10:00:00 2022 GMT test/ocsp-tests/D1_Issuer_ICA.pem Not After : Apr 13 10:00:00 2022 GMT test/ocsp-tests/ISIC_D1_Issuer_ICA.pem Not After : Apr 13 10:00:00 2022 GMT test/ocsp-tests/WSNIC_D1_Issuer_ICA.pem Not After : Apr 13 10:00:00 2022 GMT test/ocsp-tests/WKIC_D1_Issuer_ICA.pem Not After : Jun 1 00:00:00 2022 GMT test/certs/embeddedSCTs1_issuer.pem Not After : Jun 1 00:00:00 2022 GMT test/certs/embeddedSCTs1.pem building further in the future might have more failing tests: Test Summary Report ------------------- ../test/recipes/80-test_cms.t (Wstat: 1280 Tests: 6 Failed: 5) Failed tests: 1-5 Non-zero exit status: 5 ../test/recipes/80-test_ssl_new.t (Wstat: 256 Tests: 29 Failed: 1) Failed test: 12 Non-zero exit status: 1 Files=160, Tests=1893, 86 wallclock secs ( 1.22 usr 0.11 sys + 71.76 cusr 7.53 csys = 80.62 CPU) Result: FAIL Steps to Reproduce: osc co openSUSE:Factory/openssl-1_1 && cd $_ osc build --vm-type=kvm --noservice --clean --build-opt=--vm-custom-opt="-rtc base=2022-06-02T00:00:00" once that issue is fixed, try with 2028 and 2036 SUSE:SLE-15-SP2:GA/openssl-1_1 is also affected. Likely affects other enterprise codestreams as well. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1160171] New: Blender failed to launch (symbol lookup error: undefine symbol)
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1160171 Bug ID: 1160171 Summary: Blender failed to launch (symbol lookup error: undefine symbol) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: andythe_great(a)pm.me QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- kakake@linux-gsde:~> blender blender: symbol lookup error: /usr/lib64/libOpenColorIO.so.1: undefined symbol: _ZN4YAML6detail9node_data12empty_scalarB5cxx11E Try executing Blender in terminal result in this message. I did sudo zypper clean sudo zypper ref sudo zypper rm -u blender sudo zypper in blender reboot still same problem. The question was also ask here: https://forums.opensuse.org/showthread.php/538693-Blender-failed-to-launch-… Blender 2.81-2.1-x86_64 from vendor openSUSE Operating System: openSUSE Tumbleweed 20200103 KDE Plasma Version: 5.17.4 KDE Frameworks Version: 5.65.0 Qt Version: 5.13.1 Kernel Version: 5.3.12-2-default OS Type: 64-bit Processors: 8 × Intel® Core™ i7-3770 CPU @ 3.40GHz Memory: 7.5 GiB of RAM -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1027942] New: virt-manager: Missing upstream bug fixes
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1027942 Bug ID: 1027942 Summary: virt-manager: Missing upstream bug fixes Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Tools Assignee: virt-bugs(a)suse.de Reporter: carnold(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There are upstream patches fixing bugs needed for this version of virt-manager. -- You are receiving this mail because: You are on the CC list for the bug.

2 37

[Bug 1170161] New: AUDIT-FIND: enlightenment: enlightenment_system: _store_mount_verify() follows symlinks in /media/$user
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1170161 Bug ID: 1170161 Summary: AUDIT-FIND: enlightenment: enlightenment_system: _store_mount_verify() follows symlinks in /media/$user Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: simonf.lees(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: matthias.gerstner(a)suse.com, security-team(a)suse.de Blocks: 1169238 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1169238 This function rejects relative path components in the target mount path, unlike its sibbling function described in b). However, it is unaware of symlinks. Furthermore it makes sure that /media/$user and /media/$user/sub are existing and are owned by the $uid:$gid of the unprivileged user. - by placing a symlink in /media/$user/sub the setuid-root binary can be tricked to create attacker owned directories in arbitrary locations. This can quite likely lead to full root access by creating user owned directories e.g. beneath /etc that are then used by other privileged programs. - if the attacker wins a race condition he can also cause the setuid-root binary to pass ownership of arbitrary existing directories to himself. The `_store_mount_verify()` functions performs a single `stat()` call on the target mount path. Only if it exists and is not owned by the unprivileged user, the execution is aborted. Therefore if the attacker places a suitable symlink in the target path just after this `stat()` is performed by the setuid-root binary, the following `_mkdir()` invocation will `mkdir()` and `chown()` the path components nonetheless. This allows full root system access by gaining ownership of e.g. /etc or /root. To fix this I suggest not to pass ownership of /media/$user or of any sub-directories to the unprivileged user. If /media/$user is user controlled then the mount operation should be rejected. -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1170162] New: AUDIT-FIND: enlightenment: enlightenment_system: _store_umount_verify(): does not protect against shell metacharacters and relative path components
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1170162 Bug ID: 1170162 Summary: AUDIT-FIND: enlightenment: enlightenment_system: _store_umount_verify(): does not protect against shell metacharacters and relative path components Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: simonf.lees(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Blocks: 1169238 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1169238 This function tries to make sure that the user can only unmount his own mounts below /media/$user. It also rejects backslashes in the path. However it does not reject relative path components or shell characters. - this allows a regular user to unmount arbitrary file systems by passing paths like "/media/$user/../../tmp. - since the unmount is performed by calling the `umount` utility via "/bin/sh", shell metacharacters will be interpreted. Passing a path like '/media/testuser/$(date)' will cause the setuid-root program to execute the `date` program as root. This leads to full code execution as root. The only requirement is that a directory of the same name exists. Spaces are also allowed in the path, therefore even complex commands can be executed as root. I recommend to reject relative path components and shell metacharacters in this function to fix the issue. -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1155688] New: openh264 needs a later flatpak version
by bugzilla_noreply＠novell.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1155688 Bug ID: 1155688 Summary: openh264 needs a later flatpak version Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: All OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: tech4patton(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Current version in repo is 1.2.3 which is considered the "old stable". Latest version of that branch is 1.2.5 which is needed to support new features. https://github.com/flatpak/flatpak/releases/tag/1.2.5 The main feature is the support for allowing the use of extra_data for runtimes (as opposed to only for apps) which is used by the new org.freedesktop.Platform.openh264 extension. Here is what happens when I update flatpak apps ---------------------------------------------------------------------- > flatpak update Looking for updates… ID Arch Branch Op Remote Download 1. [✗] org.freedesktop.Platform.openh264 x86_64 19.08 i flathub < 593.4 kB 2. [✓] com.spotify.Client x86_64 stable u flathub 115.0 MB / 126.4 MB Warning: org.freedesktop.Platform.openh264 needs a later flatpak version Changes complete. -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1036208] New: GNOME:Factory/libostree: remount service not loaded on install
by bugzilla_noreply＠novell.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036208 Bug ID: 1036208 Summary: GNOME:Factory/libostree: remount service not loaded on install Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: sebix+novell.com(a)sebix.at QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- During my todays zypper dup run, I got this output: ( 72/408) Installing: libostree-2017.3-1.1.x86_64 ......................................................................................................[done] Additional rpm output: Failed to disable unit: No such file or directory Failed to stop ostree-remount.service.service: Unit ostree-remount.service.service not loaded. Is this a bug? The file is there: > find /usr/lib/systemd/ -name "*ostree*" /usr/lib/systemd/system/ostree-prepare-root.service /usr/lib/systemd/system/ostree-remount.service -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1176422] New: VirtualGL: unresolved symbol in libvglfaker.so
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1176422 Bug ID: 1176422 Summary: VirtualGL: unresolved symbol in libvglfaker.so Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: P.Suetterlin(a)royac.iac.es QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Trying to run a game (Victor Vran) via vglrun (or optirun....) results in woodstock:game% vglrun ./VictorVranGOG [VGL] ERROR: Could not load GLX/OpenGL functions [VGL] /usr/lib/libvglfaker.so: undefined symbol: glXGetProcAddressARB strange thing is that an 'nm /usr/lib/libvglfaker.so' lists that symbol... Other applications like glxspheres or google-earth-pro do not show this issue. Difference *might* be that the game is a 32bit application. I had reported it upstream (https://github.com/VirtualGL/virtualgl/issues/139) but they claim it's a packaging issue. Indeed, slapping together their official i386 and x64 rpms and installing them manually does not produce the above error, it works both with vglrun and optirun (using the NVidia core of my Optimus). I've tried both the version of Tumbleweed (2.6.4-1.2) and from the X11:Bumblebee repo (2.6.4-49.4). -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1191030] New: VUL-1: CVE-2021-3828: python-nltk: ReDOS vulnerability in Corpus Reader
by bugzilla_noreply＠suse.com 03 Jul '22

03 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1191030 Bug ID: 1191030 Summary: VUL-1: CVE-2021-3828: python-nltk: ReDOS vulnerability in Corpus Reader Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/311001/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: tchvatal(a)suse.com Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- nltk is vulnerable to Inefficient Regular Expression Complexity References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3828 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3828 https://github.com/nltk/nltk/commit/277711ab1dec729e626b27aab6fa35ea5efbd7e6 https://huntr.dev/bounties/d19aed43-75bc-4a03-91a0-4d0bb516bc32 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1084811] New: E-sata hotplugging stopped working since kernel 4.15
by bugzilla_noreply＠novell.com 03 Jul '22

03 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1084811 Bug ID: 1084811 Summary: E-sata hotplugging stopped working since kernel 4.15 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Factory Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: attila.schler(a)atskler.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I have noticed that on my Dell E6520 notebook the e-sata hotplugging stopped working since kernel 4.15. Currently I can observe this problem with kernel: 4.15.7-1.6-x86_64 4.16.0-rc4-4.g7a5941a-x86-64 The e-sata cable is OK, and an e-sata device can be used with kernel 4.15 if it is turned on and plugged in before powering on my notebook. (The e-sata hotplugging works well with the Leap kernel 4.12.14-lp150.5.3-x86_64.) ___ (I’m not an advanced user, but I’m ready to follow detailed instructions.) -- You are receiving this mail because: You are on the CC list for the bug.

2 2