August 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1196429] New: VUL-0: CVE-2022-21657: envoy-proxy: X.509 Extended Key Usage and Trust Purposes bypass
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1196429 Bug ID: 1196429 Summary: VUL-0: CVE-2022-21657: envoy-proxy: X.509 Extended Key Usage and Trust Purposes bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/324526/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2057272 Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade. References: https://bugzilla.redhat.com/show_bug.cgi?id=2057272 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21657 https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21657 https://github.com/envoyproxy/envoy/pull/630 http://www.cvedetails.com/cve/CVE-2022-21657/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1196422] New: VUL-0: CVE-2022-21655: envoy-proxy: Incorrect handling of internal redirects to routes with a direct response entry
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1196422 Bug ID: 1196422 Summary: VUL-0: CVE-2022-21655: envoy-proxy: Incorrect handling of internal redirects to routes with a direct response entry Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/324518/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2050757 Incorrect handling of internal redirects to routes with a direct response entry. References: https://bugzilla.redhat.com/show_bug.cgi?id=2050757 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21655 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21655 https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d… http://www.cvedetails.com/cve/CVE-2022-21655/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1196423] New: VUL-0: CVE-2022-23606: envoy-proxy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1196423 Bug ID: 1196423 Summary: VUL-0: CVE-2022-23606: envoy-proxy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/324522/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2050758 Stack exhaustion when a cluster is deleted via Cluster Discovery Service. References: https://bugzilla.redhat.com/show_bug.cgi?id=2050758 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23606 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23606 https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c17… https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf http://www.cvedetails.com/cve/CVE-2022-23606/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1196430] New: VUL-0: CVE-2022-21656: envoy-proxy: X.509 subjectAltName matching (and nameConstraints) bypass
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1196430 Bug ID: 1196430 Summary: VUL-0: CVE-2022-21656: envoy-proxy: X.509 subjectAltName matching (and nameConstraints) bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/324527/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2057271 Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted. References: https://bugzilla.redhat.com/show_bug.cgi?id=2057271 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21656 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21656 https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b177055… https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2 http://www.cvedetails.com/cve/CVE-2022-21656/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1199133] VUL-1: CVE-2022-29973: fuse-exfat, exfat-utils: allows local users to obtain data from deleted files in the filesystem
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1199133 http://bugzilla.opensuse.org/show_bug.cgi?id=1199133#c2 Ludwig Nussel <lnussel(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|lnussel(a)suse.com |security-team(a)suse.de --- Comment #2 from Ludwig Nussel <lnussel(a)suse.com> --- I'm not the maintainer. Looks rather unmaintained. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201783] VUL-0: CVE-2022-35737: sqlite3: multiple fixes
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1201783 SMASH SMASH <smash_bz(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|CVSSv3.1:SUSE:CVE-2022-3573 |CVSSv3.1:SUSE:CVE-2022-3573 |7:6.8:(AV:N/AC:H/PR:L/UI:N/ |7:6.3:(AV:L/AC:H/PR:L/UI:N/ |S:U/C:H/I:H/A:N) |S:U/C:H/I:H/A:N) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201783] VUL-0: CVE-2022-35737: sqlite3: multiple fixes
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1201783 SMASH SMASH <smash_bz(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |CVSSv3.1:SUSE:CVE-2022-3573 | |7:6.8:(AV:N/AC:H/PR:L/UI:N/ | |S:U/C:H/I:H/A:N) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201859] TW 20220719: Running windows in a VM randomly crashes the e1000 driver
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1201859 https://bugzilla.suse.com/show_bug.cgi?id=1201859#c16 Dario Faggioli <dfaggioli(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(Mathias.Homann@op | |ensuse.org) --- Comment #16 from Dario Faggioli <dfaggioli(a)suse.com> --- (In reply to Mathias Homann from comment #14) > (In reply to Claudio Fontana from comment #13) > > Current recommendation from Intel for chipsets in that family is to disable > > TSO, as the hardware issue is a won't fix unfortunately, > > > > but moved to kernel team to see if someone wants to investigate more. > > That is actually quite weird... > > This e1000 is *onboard* on a mainboard that I have been using for almost 10 > years, and this is the first time I'm seeing this happen. And no, I didn't > have a bios update or anything. > Right, the fact that it's appearing only now is what is tricky here. Mathias, I know it could be a bit of a problem, since Tumbleweed moves fast, but I think that if you'd be able to figure out which one was the latest kernel that worked well, and hence the first one where this starts to fail, that might help quite a bit pinpointing what could be causing this... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201859] TW 20220719: Running windows in a VM randomly crashes the e1000 driver
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1201859 https://bugzilla.suse.com/show_bug.cgi?id=1201859#c15 --- Comment #15 from Dario Faggioli <dfaggioli(a)suse.com> --- (In reply to Michal Kube��ek from comment #12) > I'm not really an expert on drivers, I tend to focus on core networking, > Yeah, I know. In fact, thanks for answering my call, and giving us your opinion anyway. Do you know if we there is anyone else that we can ping, that works more on these specific aspects (even if not specifically on this driver)? > but AFAICS the log excerpt in the initial comment rather indicates > a hardware/firmware issue than a software one. The watchdog timeout with > the stack trace is just a fallout of the actual problem (kernel tells us > that a packet passed to NIC to transmit has not been transmitted within > a time limit (few seconds) which should not happen unless something is > seriously wrong). > Indeed. And this is what we concluded, when we say the first instance of this bug (the one I added a reference to). What's strange here, in my opinion, is that Mathias says he has started to see this problem after a recent kernel update. I was thinking it could have been a patch that we've backported... but this is Tumbleweed, and I don't think there are many backports applied to the TW kernel. Maybe this requires a certain traffic pattern and, even if Mathias says also the workload is being the same, some unrelated change makes it now possible/more probable for such conditions to occur? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201966] New: Package yast2-installation requires xrdb and ultimately libX*
by bugzilla_noreply＠suse.com 01 Aug '22

01 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201966 Bug ID: 1201966 Summary: Package yast2-installation requires xrdb and ultimately libX* Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: r.nowagk(a)gmx.de QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Upgrading from 15.3 to 15.4 on a minimal text-mode system leads to addition of several libX* packages. This system will never run any GUI client and these libraries are in fact unused. There should be no hard requirement for them. -- You are receiving this mail because: You are on the CC list for the bug.

1 4