September 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1190038] New: VUL-0: CVE-2021-39164: matrix-synapse: Improper authorisation of /members discloses room membership to non-members
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1190038 Bug ID: 1190038 Summary: VUL-0: CVE-2021-39164: matrix-synapse: Improper authorisation of /members discloses room membership to non-members Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/308825/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: asarai(a)suse.com Found By: Security Response Team Blocker: --- rh#1999844 Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter. https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w… https://github.com/matrix-org/synapse/releases/tag/v1.41.1 https://github.com/matrix-org/synapse/commit/cb35df940a References: https://bugzilla.redhat.com/show_bug.cgi?id=1999844 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39164 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39164 https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w… https://github.com/matrix-org/synapse/releases/tag/v1.41.1 https://github.com/matrix-org/synapse/commit/cb35df940a -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1190037] New: VUL-0: CVE-2021-39163: matrix-synapse: Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1190037 Bug ID: 1190037 Summary: VUL-0: CVE-2021-39163: matrix-synapse: Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/308826/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: asarai(a)suse.com Found By: Security Response Team Blocker: --- rh#1999846 Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where the vulnerable homeserver is in the room and untrusted users are permitted to create groups (communities). By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting `enable_group_creation` has been set to `true` are impacted. Server administrators should upgrade to 1.41.1 or higher to patch the vulnerability. There are two potential workarounds. Server administrators can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value) to prevent creation of groups by non-administrators. Administrators that are using a reverse proxy could, with partial loss of group functionality, block the endpoints `/_matrix/client/r0/groups/{group_id}/rooms` and `/_matrix/client/unstable/groups/{group_id}/rooms`. https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2… https://github.com/matrix-org/synapse/releases/tag/v1.41.1 https://github.com/matrix-org/synapse/commit/cb35df940a References: https://bugzilla.redhat.com/show_bug.cgi?id=1999846 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39163 https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39163 https://github.com/matrix-org/synapse/releases/tag/v1.41.1 https://github.com/matrix-org/synapse/commit/cb35df940a -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1096833] New: VUL-0: matrix-synapse: event visibility rules not applied correctly
by bugzilla_noreply＠novell.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1096833 Bug ID: 1096833 Summary: VUL-0: matrix-synapse: event visibility rules not applied correctly Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: okurz(a)suse.com Reporter: astieger(a)suse.com QA Contact: security-team(a)suse.de Found By: --- Blocker: --- from https://github.com/matrix-org/synapse/releases/tag/v0.31.1 Changes in synapse v0.31.1 (2018-06-08) v0.31.1 fixes a security bug in the get_missing_events federation API where event visibility rules were not applied correctly. We are not aware of it being actively exploited but please upgrade asap. Bug Fixes: Fix event filtering in get_missing_events handler (PR #3371) https://github.com/matrix-org/synapse/commit/ad9edd1d968f19dd4d7c65102fe552… -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1201127] New: python-brotlicffi / setuptools build_ext reproducible builds
by bugzilla_noreply＠suse.com 24 Nov '22

24 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201127 Bug ID: 1201127 Summary: python-brotlicffi / setuptools build_ext reproducible builds Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mcepl(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Development Blocker: --- I found https://github.com/python-hyper/brotlicffi/blob/main/setup.py#L66 needed a "sorted(sources)" to become fully reproducible, but IMHO that should not have to be added into setup.py but one layer up, e.g. in build_ext similar to https://github.com/pypa/setuptools/commit/5a0404fa3875a069f7a6436f508116e85… https://github.com/pypa/setuptools/pull/1068/files -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1029190] New: Support for package variants according to the evaluation of bigger regular expressions
by bugzilla_noreply＠novell.com 24 Nov '22

24 Nov '22

http://bugzilla.suse.com/show_bug.cgi?id=1029190 Bug ID: 1029190 Summary: Support for package variants according to the evaluation of bigger regular expressions Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: All Status: NEW Severity: Enhancement Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: Markus.Elfring(a)web.de QA Contact: qa-bugs(a)suse.de CC: astieger(a)suse.com Found By: --- Blocker: --- I noticed that the parameter “--with-link-size=2” is used so far in a package specification. https://build.opensuse.org/package/view_file/openSUSE:Factory/pcre2/pcre2.s… This setting limits the size of regular expressions. I would like to work with bigger search patterns occasionally. So I suggest to generate also variants for this software with an internal link size of 3 (and 4) for the data processing with 8 and 16 bit characters. See also: Selection of system properties for the regular expressions engine at run time https://bugs.exim.org/show_bug.cgi?id=1922 By the way: How do you think about to use the specifications “LDFLAGS“ und “%{?_smp_mflags}“ as parameters for the script “%configure“ there? -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1201615] New: pcapdump does not work after installing
by bugzilla_noreply＠suse.com 23 Nov '22

23 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201615 Bug ID: 1201615 Summary: pcapdump does not work after installing Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jmader2(a)gmu.edu QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- # zypper in pcapdump Loading repository data... Reading installed packages... Resolving package dependencies... The following 2 NEW packages are going to be installed: pcapdump perl-Net-Pcap # pcapdump Can't locate Data/Hexdumper.pm in @INC (you may need to install the Data::Hexdumper module) (@INC contains: /usr/lib/perl5/site_perl/5.26.1/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.26.1 /usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.26.1 /usr/lib/perl5/5.26.1/x86_64-linux-thread-multi /usr/lib/perl5/5.26.1 /usr/lib/perl5/site_perl) at /usr/bin/pcapdump line 3. BEGIN failed--compilation aborted at /usr/bin/pcapdump line 3. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1200579] New: After upgrading Raspberry Pi4B from 15.3 to 15.4 Grub.cfg has 15.3 not 15.4 on menus
by bugzilla_noreply＠suse.com 23 Nov '22

23 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1200579 Bug ID: 1200579 Summary: After upgrading Raspberry Pi4B from 15.3 to 15.4 Grub.cfg has 15.3 not 15.4 on menus Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: aarch64 OS: openSUSE Leap 15.4 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: llrainey15(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I did 3 raspberry pi4b from 15.3 to 15.4. Everything boots normally but the grub menu shows 15.3 not 15.4. This did not happen on the X86-64 upgrades. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1201056] New: flatpak firefox from flathub chooses a bad quality helvetica font on some sites
by bugzilla_noreply＠suse.com 23 Nov '22

23 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201056 Bug ID: 1201056 Summary: flatpak firefox from flathub chooses a bad quality helvetica font on some sites Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: c.chalu(a)free.fr QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 859931 --> http://bugzilla.opensuse.org/attachment.cgi?id=859931&action=edit bad display with Helvetica Font Hello, On Tumbleweed : firefox from flathub uses a bad quality helvetica font, while firefox from openSUSE repository uses Liberation. See the screenshots. I have the same issue with flatpak on Leap 15.4 On fedora kinoite, firefox from flathub uses Liberation font, there is not the same bug as on openSUSE. Test with : https://github.com/vkohaupt/vokoscreenNG Operating System: openSUSE Tumbleweed 20220628 KDE Plasma Version: 5.25.1 KDE Frameworks Version: 5.95.0 Qt Version: 5.15.2 Kernel Version: 5.18.6-1-default (64-bit) Graphics Platform: Wayland Processors: 8 �� 11th Gen Intel�� Core�� i7-1165G7 @ 2.80GHz Memory: 7.5 Gio of RAM Graphics Processor: Mesa Intel�� Xe Graphics Manufacturer: Micro-Star International Co., Ltd. Product Name: Modern 15 A11M System Version: REV:1.0 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1203548] New: [Build 284.4] kdump BootStorage.rb fails in handle_unknown service
by bugzilla_noreply＠suse.com 23 Nov '22

23 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203548 Bug ID: 1203548 Summary: [Build 284.4] kdump BootStorage.rb fails in handle_unknown service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://openqa.opensuse.org/tests/2695240/modules/kdum p_and_crash/steps/26 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: jsrain(a)suse.com Found By: openQA Blocker: Yes ## Observation I was originally suspicious that this may be related to a missing debug repository as we've done publishing setup only recently, but it doesn't seem so from the log. Could you please investigate the kdump configuration wizzard crash? openQA test in scenario opensuse-15.5-DVD-x86_64-extra_tests_textmode@64bit fails in [kdump_and_crash](https://openqa.opensuse.org/tests/2695240/modules/kdump_an… ## Test suite description Maintainer: slindomansilla(a)suse.de. Mainly post-installation console extra tests. ## Reproducible Fails since (at least) Build [257.1](https://openqa.opensuse.org/tests/2525279) ## Expected result Last good: (unknown) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1052740] New: convert X keyboards into kbd and set unicode console font for languages with non-Latin alphabets
by bugzilla_noreply＠novell.com 22 Nov '22

22 Nov '22

http://bugzilla.suse.com/show_bug.cgi?id=1052740 Bug ID: 1052740 Summary: convert X keyboards into kbd and set unicode console font for languages with non-Latin alphabets Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: opensuse.lietuviu.kalba(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Now openSUSE for languages with Latin alphabets use converted keyboard layouts from X into kbd, also use unicode console font (as converted layouts supports it). Remaining task is to do same transition for non-Latin console keyboard layouts and set appropriate console font. Perhaps we should preconfigure option to switch between native and US QWERTY in console for these non-Latin languages and keyboard layouts. As noted in https://bugzilla.suse.com/show_bug.cgi?id=942896#c70 , As noted in https://bugzilla.suse.com/show_bug.cgi?id=942896#c69 Greek seems not have converted console keyboard layout from X into kbd. For Greek perhaps we can use eurlatgr console font (like for Latin alphabets) All Cyrillic layouts now use UniCyr_8x16.psf font, but this font seems to be compatible with cp866, cp1251, iso8859-5 and koi8-r (according http://www.tldp.org/HOWTO/Belarusian-HOWTO/x28.html) and not compatible with unicode per se. But openSUSE seems don't provide converted layouts for Russian, Ukrainian, Serbian, Bulgarian, Tajik. For Cyrillic alphabets we should use LatArCyrHeb-14, LatArCyrHeb-16+ or LatArCyrHeb-16 console font, that support unicode. -- You are receiving this mail because: You are on the CC list for the bug.

2 6