September 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1203105] VUL-0: CVE-2022-31152: matrix-synapse: denial of service due to incorrect application of event authorization rules
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1203105 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1196967] kernel 5.14, 5.16.11 and 5.17-rc7 crash on NVIDIA jetson nano
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1196967 https://bugzilla.suse.com/show_bug.cgi?id=1196967#c20 --- Comment #20 from Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> --- (In reply to Takashi Iwai from comment #18) > Also, which Nvidia GPU is on Jetson Nano? The Jetson GPU is GM20B (Maxwell), also found on the Jetson TX1. As SoC, the model is Tegra 210. Kernel commits usually mention Tegra 210 for Jetson Nano changes. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1196967] kernel 5.14, 5.16.11 and 5.17-rc7 crash on NVIDIA jetson nano
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1196967 https://bugzilla.suse.com/show_bug.cgi?id=1196967#c19 --- Comment #19 from Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> --- (In reply to Takashi Iwai from comment #17) > If you can still reproduce the problem with 5.19, at best, report this to > the upstream. It should be fixed there at first. > I was not able to reproduce this issue with 5.19. > Just to be sure: you've tested vanilla kernel, and 5.15.x is only to 5.15.13? > I'm asking it because 5.15.23 contains a known problematic stuff (the commit > f0a60c7c4edee3f108ec435d457149175d0b0afa). Yes, the vanilla versions I tested were only 5.14.15, 5.15.13, and 5.16.16. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203105] New: VUL-0: CVE-2022-31152: matrix-synapse: denial of service due to incorrect application of event authorization rules
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203105 Bug ID: 1203105 Summary: VUL-0: CVE-2022-31152: matrix-synapse: denial of service due to incorrect application of event authorization rules Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/341463/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: asarai(a)suse.com Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2124168 Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`) as a workaround. References: https://bugzilla.redhat.com/show_bug.cgi?id=2124168 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31152 https://github.com/matrix-org/synapse/pull/13087 https://github.com/matrix-org/synapse/releases/tag/v1.62.0 https://github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-47… https://github.com/matrix-org/synapse/pull/13088 https://www.cve.org/CVERecord?id=CVE-2022-31152 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1202746] How about Version 7.4
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1202746 Danilo Spinella <danilo.spinella(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |danilo.spinella(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1199150] New: python-scipy test failure with GCC 12 on i586
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1199150 Bug ID: 1199150 Summary: python-scipy test failure with GCC 12 on i586 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: rguenther(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- It materializes as [ 559s] ../../special/tests/test_kolmogorov.py::TestSmirnovp::test_oneminusoneovern <- ../../../../../usr/lib/python3.9/site-packages/scipy/special/tests/test_kolmogorov.py Fatal Python error: Floating point exception [ 559s] [ 559s] Current thread 0xf7970700 (most recent call first): [ 559s] File "/usr/lib/python3.9/site-packages/scipy/special/_testutils.py", line 213 in eval_func_at_params with gdb one sees Thread 1 "python3.9" received signal SIGFPE, Arithmetic exception. 0xd059330b in pow2Scaled_D (a=..., m=8, pExponent=0xffff81f0) at scipy/special/cephes/kolmogorov.c:607 607 y2r = pow2Scaled_D(y, r, &y2rE); 0xd05932f0 <+336>: mov 0xe0(%esp),%eax 0xd05932f7 <+343>: movaps %xmm0,0x60(%esp) 0xd05932fc <+348>: lea 0x9c(%esp),%ebp 0xd0593303 <+355>: sub $0x8,%esp 0xd0593306 <+358>: mov %ecx,0x10(%esp) 0xd059330a <+362>: cltd => 0xd059330b <+363>: idiv %ecx 0xd059330d <+365>: mov %eax,0x18(%esp) 0xd0593311 <+369>: lea 0x48(%esp),%ecx and we divide by zero. (gdb) l 602 } 603 604 q = m / maxExpt; 605 r = m % maxExpt; 606 /* y^m = (y^maxExpt)^q * y^r */ 607 y2r = pow2Scaled_D(y, r, &y2rE); 608 y2m = pow2Scaled_D(y, maxExpt, &y2mE); 609 y2mq = pow2Scaled_D(y2m, q, &y2mqE); 610 ans = frexpD(mul_DD(y2r, y2mq), &ansE); 611 y2mqE += y2mE * q; (gdb) p maxExpt $7 = 0 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1203104] VUL-0: CVE-2020-22669: owasp-modsecurity-crs: SQL injection bypass
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1203104 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194187] openssl broken
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1194187 Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jsikes(a)suse.com |pmonrealgonzalez(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203104] New: VUL-0: CVE-2020-22669: owasp-modsecurity-crs: SQL injection bypass
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203104 Bug ID: 1203104 Summary: VUL-0: CVE-2020-22669: owasp-modsecurity-crs: SQL injection bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/341471/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Thomas.Worm(a)DATEV.de Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-22669 Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications. Upstream PR: https://github.com/coreruleset/coreruleset/pull/1793 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-22669 https://www.cve.org/CVERecord?id=CVE-2020-22669 https://github.com/coreruleset/coreruleset/pull/1793 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 http://www.cvedetails.com/cve/CVE-2020-22669/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1202438] grub2 can no longer boot from an ISO
by bugzilla_noreply＠suse.com 05 Sep '22

05 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1202438 https://bugzilla.suse.com/show_bug.cgi?id=1202438#c22 --- Comment #22 from Gary Ching-Pang Lin <glin(a)suse.com> --- I added a patch to allocate the old heap size for the first memory region. Please try the testing grub2 and see if the delay is improved. https://download.opensuse.org/repositories/home:/gary_lin:/branches:/Base:/… -- You are receiving this mail because: You are on the CC list for the bug.

1 0