August 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1202059] AUDIT-0: ruby3.1-rubygem-d-installer: review of D-Bus services org.opensuse.DInstaller (and friends)
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1202059 Wolfgang Frisch <wolfgang.frisch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wolfgang.frisch(a)suse.com Assignee|security-team(a)suse.de |wolfgang.frisch(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202141] YaST samba-client - AD joined VM - pam stack issues / winbind auth / console login / ssh login ...
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1202141 https://bugzilla.suse.com/show_bug.cgi?id=1202141#c7 Samuel Cabrero <scabrero(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(rs.opensuse@spitz | |enpfeil.org) --- Comment #7 from Samuel Cabrero <scabrero(a)suse.com> --- Hi Robert, the problem is your /etc/pam.d/sshd file. It does not include the common-* files, where pam_winbind is correctly enabled. If you have edited it on purpose, please add pam_winbind to it. Otherwise, if it is a leftover after the usrmerge (https://en.opensuse.org/openSUSE:Usr_merge), check that /usr/etc/pam.d/sshd exists and delete it. For reference, this is my /usr/etc/pam.d/sshd file: > #%PAM-1.0 > auth requisite pam_nologin.so > auth include common-auth > account requisite pam_nologin.so > account include common-account > password include common-password > session required pam_loginuid.so > session include common-session > session optional pam_keyinit.so force revoke > session optional pam_lastlog.so showfailed > session optional pam_motd.so -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194810] New: ProtectHome=true prevents exim from delivering mail
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1194810 Bug ID: 1194810 Summary: ProtectHome=true prevents exim from delivering mail Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: 7eggert(a)gmx.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Exim needs to access ~/.forward, ~/.procmailrc; the procmail scripts need to access the home dir. Being blocked prevents any local mail from being delivered. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1184141] New: coturn.service: syscall restrictions are too strict
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1184141 Bug ID: 1184141 Summary: coturn.service: syscall restrictions are too strict Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: xm.koutny+suse.com(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I'm running coturn-4.5.2-lp152.20.1.x86_64 from network:telephony (on Leap 15.2). I updated from 4.5.1 (Leap) which worked fine but now I'm running into troubles: 1) Started process will terminate soon with SIGSYS 2) After resolving this, it'll fail with > 0: : ERROR: main: Cannot configure any meaningful IP listener address I strace'd both issues: 1) (very early at the start of binary, fails even with other executables, most likely anything linked with pthread) > 1974 set_tid_address(0x7fefc2c04290) = 1974 > 1974 set_robust_list(0x7fefc2c042a0, 24) = 0 > 1974 rt_sigaction(SIGRTMIN, {sa_handler=0x7fefc1fc5bf0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fefc1fd22d0}, NULL, 8) = 0 > 1974 rt_sigaction(SIGRT_1, {sa_handler=0x7fefc1fc5c90, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fefc1fd22d0}, NULL, 8) = 0 > 1974 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 > 1974 prlimit64(0, RLIMIT_STACK, NULL, <unfinished ...>) = ? > 1 <... epoll_pwait resumed>[{EPOLLHUP, {u32=2326093456, u64=94697765035664}}], 50, -1, NULL, 8) = 1 > 1974 +++ killed by SIGSYS +++ 2) > 2168 write(3, "0: : WARNING: cannot find privat"..., 69) = 69 > 2168 write(3, "0: : WARNING: cannot start TLS a"..., 95) = 95 > 2168 write(3, "0: : NO EXPLICIT LISTENER ADDRES"..., 53) = 53 > 2168 write(3, "0: : ===========Discovering list"..., 58) = 58 > 2168 socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = -1 EAFNOSUPPORT (Address family not supported by protocol) > 2168 write(3, "0: : ERROR: main: Cannot configu"..., 70) = 70 The following .service file modification fixes the issue for me: -SystemCallFilter=~@clock @debug @module @mount @raw-io @reboot @swap @privileged @resources @cpu-emulation @obsolete -RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +SystemCallFilter=~@clock @debug @module @mount @raw-io @reboot @swap @privileged @cpu-emulation @obsolete +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK Note that the first change may not be needed with systemd newer than v235 [1] (I guess I shouldn't be running coturn from network:telephony on Leap). [1] 4c3a917617 ("seccomp: include prlimit64 and ugetrlimit in @default") v235~15^2~3 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1202205] New: VUL-1: CVE-2022-37452: heap overflow
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1202205 Bug ID: 1202205 Summary: VUL-1: CVE-2022-37452: heap overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/339154/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: wullinger(a)rz.uni-kiel.de Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: poeml(a)cmdline.net Found By: Security Response Team Blocker: --- CVE-2022-37452 Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-37452 https://www.openwall.com/lists/oss-security/2022/08/06/8 https://github.com/ivd38/exim_overflow https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743 https://github.com/Exim/exim/compare/exim-4.94...exim-4.95 https://github.com/Exim/exim/wiki/EximSecurity http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37452 https://www.exim.org/static/doc/security/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1202204] New: VUL-1: CVE-2022-37451: invalid free
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1202204 Bug ID: 1202204 Summary: VUL-1: CVE-2022-37451: invalid free Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/339146/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: wullinger(a)rz.uni-kiel.de Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: poeml(a)cmdline.net Found By: Security Response Team Blocker: --- CVE-2022-37451 Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-37451 https://www.openwall.com/lists/oss-security/2022/08/06/1 https://github.com/ivd38/exim_invalid_free https://github.com/Exim/exim/compare/exim-4.95...exim-4.96 http://www.cvedetails.com/cve/CVE-2022-37451/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37451 https://github.com/Exim/exim/wiki/EximSecurity https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42 https://cwe.mitre.org/data/definitions/762.html https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html https://www.exim.org/static/doc/security/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1201852] TW: mail(1) is missing info documentation somehow
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201852 http://bugzilla.opensuse.org/show_bug.cgi?id=1201852#c21 --- Comment #21 from Adam Majer <amajer(a)suse.com> --- (In reply to Dr. Werner Fink from comment #20) > Beside this as you let mandoc conflict with man-db it is time to remove both > libalternate as well as update-alternatives from man-db I don't understand this reasoning. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201041] python-rpm-macros’s %pyproject_install doesn’t fully work with pip 20.0.2 (default in Leap 15.3 and 15.4)
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1201041 https://bugzilla.suse.com/show_bug.cgi?id=1201041#c7 --- Comment #7 from Benjamin Greiner <code(a)bnavigator.de> --- I don't have the permissions for it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201041] python-rpm-macros’s %pyproject_install doesn’t fully work with pip 20.0.2 (default in Leap 15.3 and 15.4)
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1201041 https://bugzilla.suse.com/show_bug.cgi?id=1201041#c6 --- Comment #6 from Steve Kowalik <steven.kowalik(a)suse.com> --- --ignore-installed is probably going to matter more in the long run anyway, due to pip wanting to build things in isolation given the way the wind is blowing. I say we accept the PR for python-rpm-macros and cut a new release for Leap 15.x. Ben, would you like to do the honours for accepting the PR? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190434] crash is unable to find debuginfo of usrmerged kernel
by bugzilla_noreply＠suse.com 08 Aug '22

08 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1190434 Felix Niederwanger <felix.niederwanger(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |felix.niederwanger(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0