January 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1194851] New: autoyast replaces $releasever in add-on repos with the version number (e.g. 15.3) in /etc/zypp/repos.d files
by bugzilla_noreply＠suse.com 05 Apr '23

05 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1194851 Bug ID: 1194851 Summary: autoyast replaces $releasever in add-on repos with the version number (e.g. 15.3) in /etc/zypp/repos.d files Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: AutoYaST Assignee: yast2-maintainers(a)suse.de Reporter: adaugherity(a)tamu.edu QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 855378 --> https://bugzilla.suse.com/attachment.cgi?id=855378&action=edit AutoYaST add-on profile Summary: basically #1172477, but for AutoYaST I have the update repos added to my autoyast profile so that the latest packages are installed from the start, rather than having to do the install and then run updates. See the attached file for details. (It uses my internal mirror for most repos, but this issue applies equally to download.opensuse.org.) I've started using $releasever in the AY profile so I don't have to modify it for every new release. This works, but the generated /etc/zypp/repos.d/*.repo files contain the specific version (e.g. 15.3) rather than $releasever, so when it comes time to upgrade to the next release, the documented upgrade procedure of 'zypper --releasever ...' will not work. Example: <media_url>http://download.opensuse.org/update/leap/$releasever/sle/</media_url> in the AY profile gets turned into baseurl=http://download.opensuse.org/update/leap/15.3/sle in the repo file. Note that this only applies to the URL -- $releasever in the name is left unmodified. It looks like this issue was originally fixed in AutoYaST in #972046; more details on GitHub: https://github.com/yast/yast-add-on/pull/28#issuecomment-291116098 . However, the code has been refactored since then and it seems the bug has reappeared. -- You are receiving this mail because: You are on the CC list for the bug.

1 18

[Bug 1164084] New: Sendmail upstream security bug report
by bugzilla_noreply＠novell.com 05 Apr '23

05 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1164084 Bug ID: 1164084 Summary: Sendmail upstream security bug report Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: All OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: werner(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- - Add upstream patch 8.15.2.mci.p0 * If sendmail tried to reuse an SMTP session which had already been closed by the server, then the connection cache could have invalid information about the session. One possible consequence was that STARTTLS was not used even if offered. -- You are receiving this mail because: You are on the CC list for the bug.

2 16

[Bug 1206952] New: lxd fail with new btrfs
by bugzilla_noreply＠suse.com 05 Apr '23

05 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1206952 Bug ID: 1206952 Summary: lxd fail with new btrfs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: werwolf131313(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- > lxc launch images:opensuse/15.4 test > Creating test > Error: Failed instance creation: Failed creating instance from image: Failed to run: btrfs qgroup create 0/4135 /var/lib/lxd/storage-pools/lxd-pool/images/9fac0fafb956a6ef1dee274f6694e22de1c94b20cade2f6c2a848b3a163945a3: exit status 1 (ERROR: unable to create quota group: File exists) fixed here: https://github.com/lxc/lxd/issues/11210 a rebuild of the package with this patch is required. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1206346] New: go1.20 release tracking
by bugzilla_noreply＠suse.com 05 Apr '23

05 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1206346 Bug ID: 1206346 Summary: go1.20 release tracking Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- go1.20 (expected February 2023) is a major release of Go. Minor releases of go1.20.x will be provided through February 2024. This issue tracks go1.20.x releases packaged and submitted initially to openSUSE:Factory and can be referenced in submissions to additional repositories. Go Release Cycle https://github.com/golang/go/wiki/Go-Release-Cycle Go Release history https://golang.org/doc/devel/release.html -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1189960] New: cleanup: remove or document patches.suse/btrfs-8447-serialize-subvolume-mounts-with-potentially-mi.patch
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1189960 Bug ID: 1189960 Summary: cleanup: remove or document patches.suse/btrfs-8447-serialize-subvolume-mounts-wit h-potentially-mi.patch Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: dsterba(a)suse.com Reporter: jeffm(a)suse.com QA Contact: jeffm(a)suse.com Blocks: 1189946 Found By: --- Blocker: --- This is an automated report to queue a potentially obsolete patch for removal. The patch patches.suse/btrfs-8447-serialize-subvolume-mounts-with-potentially-mi.patch will be removed from the master branch in 30 days if the assignee does not remove it before then. Alternatively, the assignee may update the patch tags and this report to indicate what efforts are being made to land the patch in the upstream kernel or to justify why it should require ongoing maintenance effort. Thank you for your cooperation. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1187511] New: Mint Y GTK Theme Uses Green for All Variants
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1187511 Bug ID: 1187511 Summary: Mint Y GTK Theme Uses Green for All Variants Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: CheeseEBoi(a)mailo.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When using the Mint Y GTK Theme from the repositories, all color variants of the theme use green for the highlights aside from the window controls. Both light and dark versions have this problem but the window decoration theme does not. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1198621] New: systemd-boot: mach bunt
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1198621 Bug ID: 1198621 Summary: systemd-boot: mach bunt Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: snwint(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1198583 Found By: --- Blocker: --- If we go for systemd-boot we need it to look nice. How about gfxboot for it? :-) -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1146936] New: nmcli-examples: add examples of bonding + vlan + bridge
by bugzilla_noreply＠novell.com 04 Apr '23

04 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1146936 Bug ID: 1146936 Summary: nmcli-examples: add examples of bonding + vlan + bridge Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: william.brown(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Configuring a bond + vlan + bridge is not completely straightforward or clear with nmcli. An example should be added such as: nmcli conn add type bond con-name bond0 ifname bond0 mode 802.3ad ipv4.method disabled ipv6.method ignore nmcli connection add type ethernet con-name bond0-eth1 ifname eth1 master bond0 slave-type bond nmcli connection add type ethernet con-name bond0-eth2 ifname eth2 master bond0 slave-type bond nmcli connection add type bridge con-name net_18 ifname net_18 ipv4.method disabled ipv6.method ignore nmcli connection add type vlan con-name bond0.18 ifname bond0.18 dev bond0 id 18 master net_18 slave-type bridge This is suitable for libvirt/vms to use the bridges. -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1176818] New: Wrong public keys in openSUSE-build-key for verifying container image signatures
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1176818 Bug ID: 1176818 Summary: Wrong public keys in openSUSE-build-key for verifying container image signatures Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: meissner(a)suse.com Reporter: rhafer(a)suse.com QA Contact: qa-bugs(a)suse.de CC: sgrunert(a)suse.com Found By: --- Blocker: --- The openSUSE-build-keys package contains /usr/lib/rpm/gnupg/keys/opensuse-container-key.asc and /usr/lib/rpm/gnupg/keys/suse-container-key.asc which symlink to the "openSUSE Project Signing Key <opensuse(a)opensuse.org>" and "SuSE Package Signing Key <build(a)suse.de>" but apparently the images we provide on registry.opensuse.org are signed by some other key. When enabling signature verification for "registry.opensuse.org" using the key "/usr/lib/rpm/gnupg/keys/opensuse-container-key.asc" all images fail to verify because the images are signed with a different key. Looking into the signatures, which are fetched from "https://registry.opensuse.org/sigstore/" it seem the images are signed by a key with the ID "D754694F9AB48CE9". The key in /usr/lib/rpm/gnupg/keys/opensuse-container-key.asc however AFAICS is: "B88B2FD43DBDC284". So something is wrong here. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1205802] New: VUL-0: CVE-2022-39346: nextcloud: Missing length validation of user displayname allows to generate an SQL error
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1205802 Bug ID: 1205802 Summary: VUL-0: CVE-2022-39346: nextcloud: Missing length validation of user displayname allows to generate an SQL error Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/348950/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: cathy.hu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2148815 Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue. https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… https://github.com/nextcloud/server/pull/33052 https://hackerone.com/reports/1588562 References: https://bugzilla.redhat.com/show_bug.cgi?id=2148815 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-39346 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… http://www.cvedetails.com/cve/CVE-2022-39346/ https://github.com/nextcloud/server/pull/33052 https://www.cve.org/CVERecord?id=CVE-2022-39346 https://hackerone.com/reports/1588562 -- You are receiving this mail because: You are on the CC list for the bug.

1 3