February 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1146452] Broken lighttpd logrotate config
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

https://bugzilla.suse.com/show_bug.cgi?id=1146452 https://bugzilla.suse.com/show_bug.cgi?id=1146452#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:0024-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1146452,1181400,1194376 CVE References: CVE-2022-22707 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): lighttpd-1.4.64-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1195459] VUL-0: CVE-2022-0408: vim: Stack-based Buffer Overflow in spellsuggest.c
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

https://bugzilla.suse.com/show_bug.cgi?id=1195459 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1195460] New: picard package is missing python yaml dependency
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195460 Bug ID: 1195460 Summary: picard package is missing python yaml dependency Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: glorp.gleep(a)protonmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Android 10; Mobile; rv:96.0) Gecko/96.0 Firefox/96.0 Build Identifier: Starting picard (installed from official repo) gives an error that the python yaml module is missing. Installing the python yaml packages from the repositories seems to have fixed the issue. I guess the dependencied need to be updated Reproducible: Always Steps to Reproduce: 1. Launch picard 2. Sadness 3. Actual Results: Error message appears. Error log shows a python error that the yaml module is missing Expected Results: App should launch normally -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1195419] Update yubikey-manager-* to latest version to support new models
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

https://bugzilla.suse.com/show_bug.cgi?id=1195419 https://bugzilla.suse.com/show_bug.cgi?id=1195419#c4 --- Comment #4 from Antonio Larrosa <alarrosa(a)suse.com> --- Yes, it compiles on 15.4 but since it contains many incompatible changes (it would be upgraded from 2.8 to 36.0.1) it would be dangerous to upgrade the package in SLE without upgrading also all python packages that depend on it, and those are too many to do it in the same day that the SLE freeze starts. The list of incompatible changes according to the .changes file: In 2.9: - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. In 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. In 3.3.0: - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. In 36.0.0: * BACKWARDS INCOMPATIBLE: The X.509 PEM parsers now require that the PEM string passed have PEM delimiters of the correct type. For example, parsing a private key PEM concatenated with a certificate PEM will no longer be accepted by the PEM certificate parser. * BACKWARDS INCOMPATIBLE: The X.509 certificate parser no longer allows negative serial numbers. RFC 5280 has always prohibited these. * BACKWARDS INCOMPATIBLE: Additional forms of invalid ASN.1 found during X.509 parsing will raise an error on initial parse rather than when the malformed field is accessed. * BACKWARDS INCOMPATIBLE: Reverted the nonstandard formatting of email address fields as E in rfc4514_string() methods from version 35.0. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1195459] New: VUL-0: CVE-2022-0408: vim: Stack-based Buffer Overflow in spellsuggest.c
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195459 Bug ID: 1195459 Summary: VUL-0: CVE-2022-0408: vim: Stack-based Buffer Overflow in spellsuggest.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/322171/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mimi.vx(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: zbalogh(a)suse.com Found By: Security Response Team Blocker: --- rh#2048515 Stack-based Buffer Overflow in Conda vim prior to 8.2. https://huntr.dev/bounties/5e635bad-5cf6-46cd-aeac-34ef224e179d https://github.com/vim/vim/commit/06f15416bb8d5636200a10776f1752c4d6e49f31 References: https://bugzilla.redhat.com/show_bug.cgi?id=2048515 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0408 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0408 https://github.com/vim/vim/commit/06f15416bb8d5636200a10776f1752c4d6e49f31 http://www.cvedetails.com/cve/CVE-2022-0408/ https://huntr.dev/bounties/5e635bad-5cf6-46cd-aeac-34ef224e179d -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1194418] Unable to wake up keyboard and mouse
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

https://bugzilla.suse.com/show_bug.cgi?id=1194418 https://bugzilla.suse.com/show_bug.cgi?id=1194418#c15 --- Comment #15 from Takashi Iwai <tiwai(a)suse.com> --- Well, you mentioned in the original report "I have to restart computer", and this has to be clarified whether it's really no other way to wake up or it's just because the USB keyboard/mouse wakeup doesn't work. The USB problem is often rather a configuration problem, you'd need to disable the runtime PM or whatever the power-saving stuff for USB. But if the wakeup / resume doesn't work with PS/2 in some condition, this is another (more severe) bug. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1195457] New: The obs-ndi package installs to the wrong directory
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195457 Bug ID: 1195457 Summary: The obs-ndi package installs to the wrong directory Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jcarricksmith(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When the obs-ndi package is installed it is placed in:- /usr/lib/obs-plugins/ however OBS-Studio looks for it in:- /usr/lib64/obs-plugins/ so NDI devices are not available to OBS-Studio. sudo ln -s /usr/lib64/obs-plugins/obs-ndi.so /usr/lib/obs-plugins/obs-ndi.so solves the problem. Thanks John -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1181392] New: sway should source /etc/profile ~/.profile etc.
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

https://bugzilla.suse.com/show_bug.cgi?id=1181392 Bug ID: 1181392 Summary: sway should source /etc/profile ~/.profile etc. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mcepl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When Gnome session starts all application have in their environment variables from /etc/profile (and ~/.profile). Sway doesn��t. It would be awfully convenient, if sway would do it as well. I cannot find anywhere in gdm/gnome files where this configuration happens, but I have met even this trick (https://tech.akom.net/archives/93-Getting-a-systemd-unit-to-read-your-.bash…) [Service] Type=simple User=some_user # Process the normal environment files for this user by starting a login shell # and outputting it all in a temp file. This makes it compatible # with the non-systemd init scripts that still rely on .bashrc ExecStartPre=/bin/bash --login -c 'env > /tmp/.magic-environment-file' ExecStart=SERVICE_COMMAND EnvironmentFile=-/tmp/.magic-environment-file -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1195454] New: SUSE Studio ImageWriter doesn't disable main window while burning
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195454 Bug ID: 1195454 Summary: SUSE Studio ImageWriter doesn't disable main window while burning Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: openSUSE Leap 15.3 Status: NEW Severity: Normal Priority: P5 - None Component: System Imaging Assignee: ms(a)suse.com Reporter: cy6erGn0m(a)gmail.com QA Contact: adrian.schroeter(a)suse.com Found By: --- Blocker: --- When an image writing is in progress, there is a progress popup window with a cancel button. The progress windows seems to be modal and the main window is "grayed", "mouseover" events in the main window are not processed: buttons are not highlighted when under the mouse pointer, just like they are disabled. In spite of that, one can actually click the image selection spot, USB selection dropdown, and the write button during image writing and change selection. So it should be one of two options: - the main window is disabled until the image writing is complete; - the main window is fully functional and the particular USB device is excluded/disabled until the image writing is complete. Versions: ImageWriter 1.10 on openSUSE Leap 15.3 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1195453] New: .desktop file runs in 15.2 but not in 15.3
by bugzilla_noreply＠suse.com 02 Feb '22

02 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195453 Bug ID: 1195453 Summary: .desktop file runs in 15.2 but not in 15.3 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: x86-64 OS: openSUSE Leap 15.3 Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: jcdole(a)free.fr QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The following desktop file function as normal user and as user root in opensuse 15.2 It functions as normal user but failed with syntax error in 15.3 as user root. In 15.3,it seems that there may be an error when running as root user because >>>kdesu -u root -c <<< is added in front of the exec key contents and any double quotes are escaped with \ perhaps differently in 15.2 15.2 success : see https://paste.opensuse.org/23593351 15.3 error : Feb 02 16:38:51 15-3-G755VW-VM-INITIAL plasmashell[1833]: kf.service.services: Parsing "exist Exec and ('kdesu -u root -c /bin/sh -c 'IP_ADDR=\"192.168.130.239\" ; while : ; do ping -c2 \"$IP_ADDR\" ; if [ $? -eq 0 ] ; then kdialog --title=\"Connexion to $IP_ADDR\" --msgbox=\"Router is alive\" ; break ; else kdialog --title \"Connexion to $IP_ADDR\" --warningcontinuecancel \"No connection\\n\\nAre you sure you want to continue pinging ?\" ; [ $? -eq 1 ] && break ; sleep 2 ; fi ; done ; echo \"You can close\" ;'' =~ Exec)" gave: syntax error Desktop file : [Desktop Entry] Comment[en_US]=TEST_SYNTAX Comment=TEST_SYNTAX Exec=/bin/sh -c 'IP_ADDR="192.168.130.239" ; while : ; do ping -c2 "$IP_ADDR" ; if [ $? -eq 0 ] ; then kdialog --title="Connexion to $IP_ADDR" --msgbox="Router is alive" ; break ; else kdialog --title "Connexion to $IP_ADDR" --warningcontinuecancel "No connection\\n\\nAre you sure you want to continue pinging ?" ; [ $? -eq 1 ] && break ; sleep 2 ; fi ; done ; echo "You can close" ;' GenericName[en_US]=TEST_SYNTAX GenericName=TEST_SYNTAX Icon=system-run MimeType= Name[en_US]=TEST_SYNTAX Name=TEST_SYNTAX Path= StartupNotify=true Terminal=false TerminalOptions=\s--noclose Type=Application X-DBUS-ServiceName= X-DBUS-StartupType=none X-KDE-SubstituteUID=true X-KDE-Username=root -- You are receiving this mail because: You are on the CC list for the bug.

1 0