May 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1198669] New: Unable to fully read some files with ntfs3
by bugzilla_noreply＠suse.com 29 Nov '22

29 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1198669 Bug ID: 1198669 Summary: Unable to fully read some files with ntfs3 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: linus.kardell(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I'm trying out the ntfs3 kernel driver on OpenSUSE Tumbleweed, but I'm unable to read some files. I also posted about this here: https://reddit.com/r/openSUSE/comments/u693vm/no_such_file_or_directory_whe… , and at https://bugzilla.kernel.org/show_bug.cgi?id=215864 The files that it happens to are a few GiB in size. It doesn't fail immediately, rather when I read it with dd status=progress the first time it reads a bit into the file (a few MiB or over a hundred MiB, depending on the files, but it seems to always be the same distance for the same file), and then throws "No such file or directory". On subsequent reads, it gets through the whole file. Only, it doesn't really, because the resulting content is wrong. It's the correct length, but past a certain point the it's all zeroes. So it never truly reads the whole file, but only sometimes throws an error (when it's not in disk cache?). The same file always comes out correct with ntfs-3g. Also, not sure if related, but after I've mounted and unmounted a few times with ntf3 and ntfs-3g, ntfs3 starts throwing errors saying: "mount: /windows/d: wrong fs type, bad option, bad superblock on /dev/sda1, missing codepage or helper program, or other error." and refuses to mount it unless I add -o ro. ntfs-3g still mounts it, and ntfs3 mounts it after rebooting. The filesystem has compression enabled, in case that matters (though the files should be incompressible, as they're gzipped). I tried running chkdsk from Windows, but that did not change anything. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1195445] New: apache2-mod_auth_kerb-5.4 broken after krb5 update
by bugzilla_noreply＠suse.com 28 Nov '22

28 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195445 Bug ID: 1195445 Summary: apache2-mod_auth_kerb-5.4 broken after krb5 update Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Apache Assignee: bnc-team-apache(a)forge.provo.novell.com Reporter: opensuse(a)htl-steyr.ac.at QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Updating the system with zypper causes the package krb5 to be updated from krb5-1.16.3-3.24.1.x86_64 to krb5-1.19.2-150300.8.3.2.x86_64 apache now fails to start if module auth_kerb is active with: Cannot load /usr/lib64/apache2/mod_auth_kerb.so into server: /usr/lib64/apache2/mod_auth_kerb.so: undefined symbol: krb5_rc_dfl_init krb5_rc_dfl_init is not defined in /usr/lib64/libkrb5.so.3.3 after updating to krb5-1.19.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1142545] New: mod_auth_kerb segmentation fault when using basic authentication
by bugzilla_noreply＠novell.com 28 Nov '22

28 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1142545 Bug ID: 1142545 Summary: mod_auth_kerb segmentation fault when using basic authentication Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Apache Assignee: bnc-team-apache(a)forge.provo.novell.com Reporter: nocera(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 811365 --> http://bugzilla.opensuse.org/attachment.cgi?id=811365&action=edit mod_auth_kerb.c patch A segmentation fault is triggered in function authenticate_user_krb5pwd() when credentials are supplied using basic authentication. A description of the bug and patch (attached to this report) is described at: https://sourceforge.net/p/modauthkerb/bugs/61/ Since mod_auth_kerb is not being actively developed, it would be convenient if the patch was applied through the openSUSE build. The source RPM already includes numerous patches to the mod_auth_kerb source. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1191514] New: [busybox-static] Warewulf3 requires additional commands
by bugzilla_noreply＠suse.com 28 Nov '22

28 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1191514 Bug ID: 1191514 Summary: [busybox-static] Warewulf3 requires additional commands Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: ihno(a)suse.com Reporter: eich(a)suse.com QA Contact: qa-bugs(a)suse.de CC: kukuk(a)suse.com Found By: Development Blocker: --- Warewulf is a popular HPC deployment tool to set up compute nodes in a cluster. It creates its own initfs using busybox (static). To operate correctly, it requires at least: 1. cttyhack - to get a console for debugging purposes 2. switch_root - to switch to the main system 3. reboot - to smoothly reboot from the debugging console. Command 1. was removed with the commit: | Wed Jul 22 09:24:42 UTC 2020 - Thorsten Kukuk <kukuk(a)suse.com> [...] | - Disable cttyhack, we don't provide the calling tools [...] This is not true, we do have a tool that's calling it. Command 2. was removed with: | Fri Mar 13 20:04:25 UTC 2020 - Thorsten Kukuk <kukuk(a)suse.com> [...] | - Merge config of default, -container and -static to be able to | drop -container variant with no reason given. Command 3. has never been enabled - as far as I can tell. If there are strong objections to (re)adding these commands, I'm fine with creating another (static) flavor of busybox - just for warewulf. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1199970] New: reaim-io-disk ext4 regression in 5.18 in mballoc
by bugzilla_noreply＠suse.com 28 Nov '22

28 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1199970 Bug ID: 1199970 Summary: reaim-io-disk ext4 regression in 5.18 in mballoc Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jack(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Marvin has bisected a small (5%) performance regression in ext4 due to commit 077d0c2c78df ("ext4: make mb_optimize_scan performance mount option work with extents"). The bisection result looks like: good-27b38686 bad-077d0c2c Hmean disk-1 537.83 529.10 Hmean disk-5 3433.28 3431.71 ... Hmean disk-25 16999.09 16290.18 * -3.67%* Hmean disk-29 19162.99 18385.46 * -4.73%* Hmean disk-33 21859.13 20793.95 * -4.54%* The regression was reported on laurel1. Likely the overhead of mballoc has somewhat increased due to rbtree searching of best group to use. -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1174749] New: Gedit: gedit-ternimal can not change directory
by bugzilla_noreply＠suse.com 26 Nov '22

26 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1174749 Bug ID: 1174749 Summary: Gedit: gedit-ternimal can not change directory Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: hillwoodroc(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 840229 --> http://bugzilla.opensuse.org/attachment.cgi?id=840229&action=edit The screen record Open a text document with gedit, pop the menu with right-click and choose "Change Directory" ingedit-ternimal, but nothing happens. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1193516] New: Telegram-desktop should be updated to a valid version
by bugzilla_noreply＠suse.com 26 Nov '22

26 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1193516 Bug ID: 1193516 Summary: Telegram-desktop should be updated to a valid version Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: hillwoodroc(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 854394 --> http://bugzilla.opensuse.org/attachment.cgi?id=854394&action=edit 2.5.8 The Telegram-desktop popups a warning "Please update you app to the latest version. The version you are using is out of data and will not no longer work. " It should be updated for Leap. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1195316] New: matrix-synapse 1.50.2-1.1 does not start because of missing python38-prometheus-client dep
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195316 Bug ID: 1195316 Summary: matrix-synapse 1.50.2-1.1 does not start because of missing python38-prometheus-client dep Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: opensuse(a)arnavion.dev QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- With matrix-synapse from tumbleweed OSS repo, trying to start it results in: ERROR:root:Needed prometheus_client>=0.4.0 but it was not installed Missing Requirements: "prometheus_client>=0.4.0" To install run: pip install --upgrade --force "prometheus_client>=0.4.0" Package python38-prometheus-client was not installed because it's not in the required deps: $ zypper info --requires matrix-synapse ... Requires : [44] /bin/bash /usr/bin/python3 /usr/bin/perl python(abi) = 3.8 python38-base = 3.8.12 python38-Pillow = 8.4.0 python38-lxml = 4.7.1 python38-Authlib = 0.15.5 python38-Jinja2 = 3.0.3 python38-PyJWT = 2.3.0 python38-PyNaCl = 1.5.0 python38-PyYAML = 6.0 python38-Pympler = 1.0 python38-Twisted = 21.7.0 python38-attrs = 21.4.0 python38-bcrypt = 3.2.0 python38-bleach = 3.3.0 python38-canonicaljson = 1.5.0 python38-cryptography = 36.0.1 python38-frozendict = 2.1.3 python38-idna = 3.3 python38-ijson = 3.1.4 python38-jsonschema = 3.2.0 python38-matrix_common = 1.0.0 python38-msgpack = 1.0.3 python38-netaddr = 0.8.0 python38-phonenumbers = 8.12.40 python38-psutil = 5.9.0 python38-psycopg2 = 2.9.3 python38-pyOpenSSL = 21.0.0 python38-pyasn1 = 0.4.8 python38-pyasn1-modules = 0.2.8 python38-pymacaroons = 0.13.0 python38-pysaml2 = 7.0.1 python38-service_identity = 18.1.0 python38-signedjson = 1.1.1 python38-six = 1.16.0 python38-sortedcontainers = 2.4.0 python38-systemd = 234 python38-treq = 21.1.0 python38-typing_extensions = 3.10.0.2 python38-unpaddedbase64 = 1.1.0 /bin/sh sysuser-shadow >= 3.1 This is because the specfile references %{use_python}-prometheus_client (underscore instead of hyphen). I verified that changing to hyphen fixed it for me in TW, and I sent https://build.opensuse.org/request/show/949812 for it. It looks like this package went back-and-forth between underscores and hyphens. Factory currently has hyphen, 15.3 has underscore, and 15.2 has both (?!) So like I noted in the request, I'm not sure if Factory's specfile can just use hyphen always, or if it needs to do something like this: %if 0%{?suse_version} >= 1550 BuildRequires: %{use_python}-prometheus-client >= 0.4.0 %requires_eq %{use_python}-prometheus-client %else BuildRequires: %{use_python}-prometheus_client >= 0.4.0 %requires_eq %{use_python}-prometheus_client %endif -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1193005] New: VUL-1: CVE-2021-41281: synapse: Path traversal when downloading remote media
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1193005 Bug ID: 1193005 Summary: VUL-1: CVE-2021-41281: synapse: Path traversal when downloading remote media Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/315558/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: meissner(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41281 https://github.com/matrix-org/synapse/releases/tag/v1.47.1 https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-43… Impact Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected. Patches Server administrators should upgrade to 1.47.1 or later. Workarounds Server administrators using a reverse proxy could, at the expense of losing media functionality, block the following endpoints: /_matrix/media/r0/download/{serverName}/{mediaId} /_matrix/media/r0/download/{serverName}/{mediaId}/{fileName} /_matrix/media/r0/thumbnail/{serverName}/{mediaId} Alternatively, non-containerized deployments can be adapted to use the hardened systemd config, located at contrib/systemd/override-hardened.conf. References n/a For more information If you have any questions or comments about this advisory, e-mail us at security(a)matrix.org. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1190038] New: VUL-0: CVE-2021-39164: matrix-synapse: Improper authorisation of /members discloses room membership to non-members
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1190038 Bug ID: 1190038 Summary: VUL-0: CVE-2021-39164: matrix-synapse: Improper authorisation of /members discloses room membership to non-members Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/308825/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: asarai(a)suse.com Found By: Security Response Team Blocker: --- rh#1999844 Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter. https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w… https://github.com/matrix-org/synapse/releases/tag/v1.41.1 https://github.com/matrix-org/synapse/commit/cb35df940a References: https://bugzilla.redhat.com/show_bug.cgi?id=1999844 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39164 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39164 https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w… https://github.com/matrix-org/synapse/releases/tag/v1.41.1 https://github.com/matrix-org/synapse/commit/cb35df940a -- You are receiving this mail because: You are on the CC list for the bug.

1 2