September 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1202828] New: libva driver_data in vdpau_common_Initialize can have a null pointer for x11_dpy which is not checked
by bugzilla_noreply＠suse.com 28 Nov '22

28 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1202828 Bug ID: 1202828 Summary: libva driver_data in vdpau_common_Initialize can have a null pointer for x11_dpy which is not checked Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: gfx-bugs(a)suse.de Found By: --- Blocker: --- This caused a crash via firefox ``` (gdb) bt #0 XDisplayString (dpy=0x0) at /usr/src/debug/libX11-1.8.1-2.1.x86_64/src/Macros.c:119 #1 0x00007fdbae377b85 in vdpau_common_Initialize (driver_data=0x7fdbb18b6800) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.9.x86_64/src/vdpau_driver.c:188 #2 vdpau_Initialize_Current (ctx=0x7fdbb0fed3e0) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.9.x86_64/src/vdpau_driver_template.h:561 #3 __vaDriverInit_1_14 (ctx=0x7fdbb0fed3e0) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.9.x86_64/src/vdpau_driver.c:317 #4 0x00007fdbae334fcf in va_openDriver (dpy=dpy@entry=0x7fdbbcb30480, driver_name=<optimized out>) at /usr/src/debug/libva-2.15.0-1.1.x86_64/va/va.c:525 #5 0x00007fdbae33ae0e in vaInitialize (dpy=0x7fdbbcb30480, major_version=0x7ffec62bdbfc, minor_version=0x7ffec62bdc00) at /usr/src/debug/libva-2.15.0-1.1.x86_64/va/va.c:743 #6 0x00007fdbb5b0d002 in vaInitialize () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/media/mozva/mozva.c:411 #7 vaInitialize () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/media/mozva/mozva.c:408 #8 childvaapitest () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1012 #9 vaapitest () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1071 #10 childgltest () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1164 #11 0x00007fdbb5b60dde in fire_glxtest_process () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1200 #12 XREMain::XRE_mainInit () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:4017 #13 XREMain::XRE_mainInit () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:3903 #14 XREMain::XRE_main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:5916 #15 XRE_main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:6010 #16 0x000056092672e3fd in do_main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/browser/app/nsBrowserApp.cpp:227 #17 0x0000560926726c20 in main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/browser/app/nsBrowserApp.cpp:406 ``` though another interesting question is ... why was that a null pointer in first place. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1201459] New: VUL-0: CVE-2021-41396: live555: Heap buffer overflow in Live555 through 1.08
by bugzilla_noreply＠suse.com 28 Nov '22

28 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1201459 Bug ID: 1201459 Summary: VUL-0: CVE-2021-41396: live555: Heap buffer overflow in Live555 through 1.08 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/337006/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: cathy.hu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41396 Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41396 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41396 http://lists.live555.com/pipermail/live-devel/2021-September/021994.html http://www.live555.com/liveMedia/public/changelog.txt -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1202983] New: simple-framebuffer error -16 on raspberry pi 4 using latest openSUSE MicroOS RaspberryPi image
by bugzilla_noreply＠suse.com 27 Nov '22

27 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1202983 Bug ID: 1202983 Summary: simple-framebuffer error -16 on raspberry pi 4 using latest openSUSE MicroOS RaspberryPi image Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: proprietaer1(a)mailbox.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Today I wanted to test MicroOS on my RaspberryPi 4. Unfortunately, the display output stopped during the boot process, with the error: simple-framebuffer.0: [drm] ERROR could not acquire memory range [mem 0x3e3cf000-0x3ebb7fff flags 0x200]: error -16 Steps to reproduce: 1.Download latest MicroOS for RaspberryPi & flash it to sd card. 2.Try to boot the system -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1174749] New: Gedit: gedit-ternimal can not change directory
by bugzilla_noreply＠suse.com 26 Nov '22

26 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1174749 Bug ID: 1174749 Summary: Gedit: gedit-ternimal can not change directory Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: hillwoodroc(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 840229 --> http://bugzilla.opensuse.org/attachment.cgi?id=840229&action=edit The screen record Open a text document with gedit, pop the menu with right-click and choose "Change Directory" ingedit-ternimal, but nothing happens. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1193516] New: Telegram-desktop should be updated to a valid version
by bugzilla_noreply＠suse.com 26 Nov '22

26 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1193516 Bug ID: 1193516 Summary: Telegram-desktop should be updated to a valid version Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: hillwoodroc(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 854394 --> http://bugzilla.opensuse.org/attachment.cgi?id=854394&action=edit 2.5.8 The Telegram-desktop popups a warning "Please update you app to the latest version. The version you are using is out of data and will not no longer work. " It should be updated for Leap. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1202443] New: kdump: replace mkinitrd wrapper with native dracut
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1202443 Bug ID: 1202443 Summary: kdump: replace mkinitrd wrapper with native dracut Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: jbohac(a)suse.com Reporter: antonio.feijoo(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1202351 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1202351 +++ Upstream support removed in March 2021 (https://github.com/dracutdevs/dracut/commit/43df4ee2) and deprecation announcement on factory mailing list in May 2021 (https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/…) ALP will not ship the mkinitrd wrapper, so it's better to get rid of it in Tumbleweed first. Affected packages that need to be updated before (at least): # zypper se --requires mkinitrd Loading repository data... Reading installed packages... S | Name | Summary | Type ---+---------------------+----------------------------------------------------+-------- | kernel-debug | A Debug Version of the Kernel | package i+ | kernel-default | The Standard Kernel | package | kernel-default-base | The Standard Kernel - base modules | package | kernel-kvmsmall | The Small Developer Kernel for KVM | package | kernel-pae | Kernel with PAE Support | package | kernel-vanilla | The Standard Kernel - without any SUSE patches | package i | mdadm | Utility for configuring "MD" software RAID devices | package -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1200603] New: python-paramiko: SSHException: Invalid key with ed25519 key
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1200603 Bug ID: 1200603 Summary: python-paramiko: SSHException: Invalid key with ed25519 key Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jbaier(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Following trace suggests, that the current version of python-paramiko in Leap 15.4 (i.e. python-paramiko 2.4.2-150100.6.12.1) is suffering from a known bug https://github.com/paramiko/paramiko/issues/1306 File "/usr/lib/python3.6/site-packages/paramiko/client.py", line 749, in _auth raise saved_exception File "/usr/lib/python3.6/site-packages/paramiko/client.py", line 720, in _auth filename, pkey_class, passphrase File "/usr/lib/python3.6/site-packages/paramiko/client.py", line 571, in _key_from_filepath key = klass.from_private_key_file(key_path, password) File "/usr/lib/python3.6/site-packages/paramiko/pkey.py", line 217, in from_private_key_file key = cls(filename=filename, password=password) File "/usr/lib/python3.6/site-packages/paramiko/ed25519key.py", line 81, in __init__ signing_key = self._parse_signing_key_data(data, password) File "/usr/lib/python3.6/site-packages/paramiko/ed25519key.py", line 156, in _parse_signing_key_data message = Message(unpad(private_data)) File "/usr/lib/python3.6/site-packages/paramiko/ed25519key.py", line 41, in unpad raise SSHException("Invalid key") paramiko.ssh_exception.SSHException: Invalid key According to changelog, the solution would be to upgrade to version at least 2.5.1 (we currently have 2.11 in TW). As an alternative, the fix (https://patch-diff.githubusercontent.com/raw/ploxiln/paramiko-ng/pull/5.pat…) seems to be also back-ported into 2.4 branch as version 2.4.3. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1201229] New: VUL-0: CVE-2022-31052,CVE-2022-31052: synapse: DoS due to unbounded recusion
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201229 Bug ID: 1201229 Summary: VUL-0: CVE-2022-31052,CVE-2022-31052: synapse: DoS due to unbounded recusion Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/335801/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: meissner(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2102872 Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. Deployments with `url_preview_enabled: false` set in configuration are not affected. Deployments with `url_preview_enabled: true` set in configuration **are** affected. Deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`. Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher. Users unable to upgrade should set `url_preview_enabled` to false. https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx… https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372… References: https://bugzilla.redhat.com/show_bug.cgi?id=2102872 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31052 https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31052 https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx… https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1195316] New: matrix-synapse 1.50.2-1.1 does not start because of missing python38-prometheus-client dep
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1195316 Bug ID: 1195316 Summary: matrix-synapse 1.50.2-1.1 does not start because of missing python38-prometheus-client dep Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: opensuse(a)arnavion.dev QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- With matrix-synapse from tumbleweed OSS repo, trying to start it results in: ERROR:root:Needed prometheus_client>=0.4.0 but it was not installed Missing Requirements: "prometheus_client>=0.4.0" To install run: pip install --upgrade --force "prometheus_client>=0.4.0" Package python38-prometheus-client was not installed because it's not in the required deps: $ zypper info --requires matrix-synapse ... Requires : [44] /bin/bash /usr/bin/python3 /usr/bin/perl python(abi) = 3.8 python38-base = 3.8.12 python38-Pillow = 8.4.0 python38-lxml = 4.7.1 python38-Authlib = 0.15.5 python38-Jinja2 = 3.0.3 python38-PyJWT = 2.3.0 python38-PyNaCl = 1.5.0 python38-PyYAML = 6.0 python38-Pympler = 1.0 python38-Twisted = 21.7.0 python38-attrs = 21.4.0 python38-bcrypt = 3.2.0 python38-bleach = 3.3.0 python38-canonicaljson = 1.5.0 python38-cryptography = 36.0.1 python38-frozendict = 2.1.3 python38-idna = 3.3 python38-ijson = 3.1.4 python38-jsonschema = 3.2.0 python38-matrix_common = 1.0.0 python38-msgpack = 1.0.3 python38-netaddr = 0.8.0 python38-phonenumbers = 8.12.40 python38-psutil = 5.9.0 python38-psycopg2 = 2.9.3 python38-pyOpenSSL = 21.0.0 python38-pyasn1 = 0.4.8 python38-pyasn1-modules = 0.2.8 python38-pymacaroons = 0.13.0 python38-pysaml2 = 7.0.1 python38-service_identity = 18.1.0 python38-signedjson = 1.1.1 python38-six = 1.16.0 python38-sortedcontainers = 2.4.0 python38-systemd = 234 python38-treq = 21.1.0 python38-typing_extensions = 3.10.0.2 python38-unpaddedbase64 = 1.1.0 /bin/sh sysuser-shadow >= 3.1 This is because the specfile references %{use_python}-prometheus_client (underscore instead of hyphen). I verified that changing to hyphen fixed it for me in TW, and I sent https://build.opensuse.org/request/show/949812 for it. It looks like this package went back-and-forth between underscores and hyphens. Factory currently has hyphen, 15.3 has underscore, and 15.2 has both (?!) So like I noted in the request, I'm not sure if Factory's specfile can just use hyphen always, or if it needs to do something like this: %if 0%{?suse_version} >= 1550 BuildRequires: %{use_python}-prometheus-client >= 0.4.0 %requires_eq %{use_python}-prometheus-client %else BuildRequires: %{use_python}-prometheus_client >= 0.4.0 %requires_eq %{use_python}-prometheus_client %endif -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1193005] New: VUL-1: CVE-2021-41281: synapse: Path traversal when downloading remote media
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1193005 Bug ID: 1193005 Summary: VUL-1: CVE-2021-41281: synapse: Path traversal when downloading remote media Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/315558/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: meissner(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41281 https://github.com/matrix-org/synapse/releases/tag/v1.47.1 https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-43… Impact Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected. Patches Server administrators should upgrade to 1.47.1 or later. Workarounds Server administrators using a reverse proxy could, at the expense of losing media functionality, block the following endpoints: /_matrix/media/r0/download/{serverName}/{mediaId} /_matrix/media/r0/download/{serverName}/{mediaId}/{fileName} /_matrix/media/r0/thumbnail/{serverName}/{mediaId} Alternatively, non-containerized deployments can be adapted to use the hardened systemd config, located at contrib/systemd/override-hardened.conf. References n/a For more information If you have any questions or comments about this advisory, e-mail us at security(a)matrix.org. -- You are receiving this mail because: You are on the CC list for the bug.

1 2