August 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1202067] MicroOS Desktop: unacceptable TLS certificate
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1202067 https://bugzilla.suse.com/show_bug.cgi?id=1202067#c7 --- Comment #7 from David Diaz <dgonzalez(a)suse.com> --- But(In reply to Axel Braun from comment #5) > Problem is that MicroOS comes w/o YaST, and by this w/o save_y2logs as well. > How to proceed? I see, but the system was installed using YaST, right? So, there are two options: - Collect and upload files found in /var/log/YaST2 - Install yast2-logs and proceed as usual Does any of those two options work for you? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202134] New: windows:mingw:win{32|64}/mingw{32|64}-xz: different package naming for static development package
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1202134 Bug ID: 1202134 Summary: windows:mingw:win{32|64}/mingw{32|64}-xz: different package naming for static development package Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: fstrba(a)suse.com Reporter: ralf.habacker(a)freenet.de QA Contact: screening-team-bugs(a)suse.de CC: fridrich.strba(a)bluewin.ch, hib(a)hiberis.nl, mkbosmans(a)gmail.com Found By: --- Blocker: --- Development packages for static libraries are mainly named <package>-devel-static, while the xz package uses <package>-static-devel, which should be renamed to match the other packages. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201852] TW: mail(1) is missing info documentation somehow
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201852 http://bugzilla.opensuse.org/show_bug.cgi?id=1201852#c14 Dr. Werner Fink <werner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #14 from Dr. Werner Fink <werner(a)suse.com> --- (In reply to Matej Cepl from comment #13) > (In reply to Dr. Werner Fink from comment #11) > > Enforce deinstallation of package info > > > > rpm -e info --nodeps > > > > then reinstall > > > > zypper in info > > OK, this helped. I wonder how it did happen. https://suse.slack.com/archives/C02D2AQA7MZ/p1659511942303159 a bug in info %filetriggerun scriptlet which had removed in case of an update all entries within dir top node ... after updating twice this should not happen anymore -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202067] MicroOS Desktop: unacceptable TLS certificate
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1202067 https://bugzilla.suse.com/show_bug.cgi?id=1202067#c6 Lukas Ocilka <locilka(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(dgonzalez(a)suse.co |needinfo?(axel.braun(a)gmx.de |m) |) --- Comment #6 from Lukas Ocilka <locilka(a)suse.com> --- Attach /var/log/YaST2 directory PLS. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201632] New: kernel 5.3.18-150300.59.81-default: host fails to start qemu guests
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201632 Bug ID: 1201632 Summary: kernel 5.3.18-150300.59.81-default: host fails to start qemu guests Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: x86-64 OS: openSUSE Leap 15.3 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: hsk17(a)mail.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- after latest kernel patch upgrade, i.e. from kernel-default-5.3.18-150300.59.76.1 to kernel-default-5.3.18-150300.59.81.1, on host, host fails to start libvirt/qemu guests: "virsh start guest" reports guest started, but guest remains inaccessible, and the console window within virt-manager stays at a pure black screen. reboot host to previous kernel 5.3.18-150300.59.76-default, and qemu guests start up as usual. i observed this on hosts running leap 15.3 with all patches installed. which further information about the case is needed? -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1202070] New: nautilus (gvfsd) fails to open admin:/// URL due to missing pkexec
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1202070 Bug ID: 1202070 Summary: nautilus (gvfsd) fails to open admin:/// URL due to missing pkexec Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: arvidjaar(a)gmail.com QA Contact: qa-bugs(a)suse.de CC: meissner(a)suse.com, os.gnome.maintainers(a)gmail.com Found By: --- Blocker: --- Instead of opening super-user browser "nautilus admin:///" fails with Oops! Something went wrong. Don't have permission to access the requested location. The reason is missing pkexec: 1986 execve("/bin/sh", ["/bin/sh", "-c", "pkexec /usr/libexec/gvfs/gvfsd-admin \"$@\" --address $DBUS_SESSION_BUS_ADDRESS --dir $XDG_RUNTIME_DIR", "gvfsd-admin", "--spawner", ":1.12", "/org/gtk/gvfs/exec_spaw/3"], 0x7ffe1fec9ea8 /* 69 vars */ <unfinished ...> ... 1986 write(2, "gvfsd-admin: line 1: pkexec: command not found\n", 47) = 47 because of * Mon Jul 18 2022 Marcus Meissner <meissner(a)suse.com> - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). Probably gvfs-backends (which includes admin backend) should have hard requirement on pkexec. Besides, I would really hope packagers started to use split-aliases when factoring out commands into separate packages (https://en.opensuse.org/openSUSE:Upgrade_dependencies_explanation#Splitting…) pkexec Provides: polkit:/usr/bin/pkexec -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1201800] New: VUL-1: libostree: ed25519: Invalid out of bound reads
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201800 Bug ID: 1201800 Summary: VUL-1: libostree: ed25519: Invalid out of bound reads Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gnome-bugs(a)suse.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de Found By: --- Blocker: --- It was discovered that in ostree before 2022.5 the ed25519 signature verification code did not check that the signature is the correct length. As a result, if the signature is too short, libsodium would end up reading a few bytes out of bounds. Theoretically, this could cause an bad signature to be accepted. However, for this to happen, the out-of-bounds data would need to form a valid signature when combined with the actual data, which means that the file must have actually been signed. A more likely possibility is that libsodium winds up reading into an adjacent unmapped page and crashes. The second was that if there are N keys in the keyring, M revoked keys, and O signatures, libostree will consume O(N * M * O) (cubic) time checking for key revocation. This can be reduced to O(N * O + M log M + N) time or better by using an associative array to filter out revoked keys and by moving the revocation check out of the for-each-signature loop. References: https://github.com/ostreedev/ostree/security/advisories/GHSA-gqf4-p3gv-g8vw https://github.com/ostreedev/ostree/commit/83e6357186be11fb8f2a6b66fab3730c… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1201770] New: VUL-0: CVE-2014-9862: libostree: bundled bsdiff Improper checking of input allows arbitrary write on heap
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201770 Bug ID: 1201770 Summary: VUL-0: CVE-2014-9862: libostree: bundled bsdiff Improper checking of input allows arbitrary write on heap Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gnome-bugs(a)suse.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de Found By: --- Blocker: --- see bug 990660 / CVE-2014-9862 libostree has a bundled version of bsdiff from https://github.com/ostreedev/ostree/releases/tag/v2022.1 > The git submodule for bsdiff has been updated to latest upstream revision, > picking up additional bound-checks and fixing CVE-2014-9862. https://github.com/ostreedev/ostree/commit/97399c166dbf402c7948a96d770ce55d… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1191033] gdm: use %_pam_moduledir
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1191033 http://bugzilla.opensuse.org/show_bug.cgi?id=1191033#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1191033) was mentioned in https://build.opensuse.org/request/show/992700 Factory / gdm -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202067] MicroOS Desktop: unacceptable TLS certificate
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1202067 https://bugzilla.suse.com/show_bug.cgi?id=1202067#c5 Axel Braun <axel.braun(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(axel.braun(a)gmx.de |needinfo?(dgonzalez(a)suse.co |) |m) --- Comment #5 from Axel Braun <axel.braun(a)gmx.de> --- Problem is that MicroOS comes w/o YaST, and by this w/o save_y2logs as well. How to proceed? -- You are receiving this mail because: You are on the CC list for the bug.

1 0