November 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1176818] New: Wrong public keys in openSUSE-build-key for verifying container image signatures
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1176818 Bug ID: 1176818 Summary: Wrong public keys in openSUSE-build-key for verifying container image signatures Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: meissner(a)suse.com Reporter: rhafer(a)suse.com QA Contact: qa-bugs(a)suse.de CC: sgrunert(a)suse.com Found By: --- Blocker: --- The openSUSE-build-keys package contains /usr/lib/rpm/gnupg/keys/opensuse-container-key.asc and /usr/lib/rpm/gnupg/keys/suse-container-key.asc which symlink to the "openSUSE Project Signing Key <opensuse(a)opensuse.org>" and "SuSE Package Signing Key <build(a)suse.de>" but apparently the images we provide on registry.opensuse.org are signed by some other key. When enabling signature verification for "registry.opensuse.org" using the key "/usr/lib/rpm/gnupg/keys/opensuse-container-key.asc" all images fail to verify because the images are signed with a different key. Looking into the signatures, which are fetched from "https://registry.opensuse.org/sigstore/" it seem the images are signed by a key with the ID "D754694F9AB48CE9". The key in /usr/lib/rpm/gnupg/keys/opensuse-container-key.asc however AFAICS is: "B88B2FD43DBDC284". So something is wrong here. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1205802] New: VUL-0: CVE-2022-39346: nextcloud: Missing length validation of user displayname allows to generate an SQL error
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1205802 Bug ID: 1205802 Summary: VUL-0: CVE-2022-39346: nextcloud: Missing length validation of user displayname allows to generate an SQL error Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/348950/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: cathy.hu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2148815 Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue. https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… https://github.com/nextcloud/server/pull/33052 https://hackerone.com/reports/1588562 References: https://bugzilla.redhat.com/show_bug.cgi?id=2148815 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-39346 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… http://www.cvedetails.com/cve/CVE-2022-39346/ https://github.com/nextcloud/server/pull/33052 https://www.cve.org/CVERecord?id=CVE-2022-39346 https://hackerone.com/reports/1588562 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1202792] New: OpenVPN in Leap 15.4 seems to be built without --enable-iproute2
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1202792 Bug ID: 1202792 Summary: OpenVPN in Leap 15.4 seems to be built without --enable-iproute2 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: georg.jansing(a)web.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am using OpenVPN for several years on openSUSE (42.2 or so?) and always used a setup with a non-root user as advertized in https://openvpn.net/community-resources/how-to/#security (Unprivileged mode) This requires "--enable-iproute2" to be passed to configure at build time (at least as per current documentation). Either this was not the case in the Leap 15.3 version (2.4.x) or it was disabled in the 15.4 version for some reason. Could this flag be enabled (again) for the 15.4 package or is there a strong reason against it? From a -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1172949] New: iphone not recognized when plugged into usb port
by bugzilla_noreply＠suse.com 02 Apr '23

02 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1172949 Bug ID: 1172949 Summary: iphone not recognized when plugged into usb port Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: 64bit OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: 1chip(a)protonmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 838816 --> http://bugzilla.opensuse.org/attachment.cgi?id=838816&action=edit dmesg output when Iphone x is plugged into usb port it only charges.Can't import any photos and does not show up in dolphin. Using opensuse leap 15.2 with KDe plasma 5.18.5 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1202078] New: Plasma wayland cannot be set as default with autologin
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1202078 Bug ID: 1202078 Summary: Plasma wayland cannot be set as default with autologin Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: noga.dany(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Leap 15.4 with Plasma KDE 5.24.4 and all updates installed with autologin enabled. It works fine on X11. I tried to set Plasma Wayland as default via "System Settings-->Startup and Shutdown-->Login Screen (SDDM)-->Behavior-->choose Plasma Wayland", but then I will end in console instead in Plasma. Plasma Wayland itself works, if I keep old settings with autologin into X11 and then I just unlog to SDDM, change session and log with Wayland, it is ok. Just autologin will not boot. I can reproduce it both on my freshly installed Laptop with i5-11400H cpu with integrated graphics and in VirtualBox. I tested behavior in Fedora 36 without updates (similar components, Plasma 5.24.3, etc) and there autologin settings works fine. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1200983] New: mouse & keyboard not available in X/plasma
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1200983 Bug ID: 1200983 Summary: mouse & keyboard not available in X/plasma Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: opensuse(a)mike.franken.de QA Contact: gfx-bugs(a)suse.de Found By: --- Blocker: --- Starting with a few Tumbleweed snapshots ago I always have the problem, that mouse and keyboard are not working in my X/plasma desktop. I always have to unplug und plug them in again. After that they work as expected. There are no obvious error messages, that could help me to solve this problem. -- You are receiving this mail because: You are on the CC list for the bug.

1 24

[Bug 1203190] New: VUL-1: CVE-2022-35931: nextcloud: Password Policy app could generate passwords that would be block
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1203190 Bug ID: 1203190 Summary: VUL-1: CVE-2022-35931: nextcloud: Password Policy app could generate passwords that would be block Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/341558/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2022-35931 Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-35931 https://www.cve.org/CVERecord?id=CVE-2022-35931 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c… https://github.com/nextcloud/password_policy/pull/363 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1201070] New: Tumbleweed 20220629: can't install nextcloud-desktop
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1201070 Bug ID: 1201070 Summary: Tumbleweed 20220629: can't install nextcloud-desktop Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: Mathias.Homann(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I'm trying to install the nextcloud desktop client on TW 20220629 but it fails with dependency issues: twvm:~ # zypper in nextcloud-desktop Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides 'libQt5Gui.so.5(Qt_5.15.2_PRIVATE_API)(64bit)' needed by the to be installed nextcloud-desktop-3.5.1-1.1.x86_64 Solution 1: do not install nextcloud-desktop-3.5.1-1.1.x86_64 Solution 2: break nextcloud-desktop-3.5.1-1.1.x86_64 by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c/d/?] (c): c twvm:~ # cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20220629" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20220629" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:tumbleweed:20220629" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo-Tumbleweed" on TW 20220628 it installs ok. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1200511] New: evince keeps crashing
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1200511 Bug ID: 1200511 Summary: evince keeps crashing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: wardlawhunter(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am getting consistent crashes from evince when trying to view a pdf. If I scroll or page down through this pdf about 10 pages it will reliably crash. The terminal produces the following error output after crashing: evince: cairo-error.c:68: _cairo_error: Assertion `_cairo_status_is_error (status)' failed. Aborted (core dumped) -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1189907] New: gnome-software: packages from the main distro repository should not be marked as potentially dangerous
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1189907 Bug ID: 1189907 Summary: gnome-software: packages from the main distro repository should not be marked as potentially dangerous Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- it should work more like software.o.o categorizes packages. i think the main culprit might be that it doesnt have any permissions information like it has for flatpak based apps. -- You are receiving this mail because: You are on the CC list for the bug.

1 2