November 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1215657] New: VUL-0: CVE-2023-42811: rage-encryption: aes-gcm: chosen ciphertext attack via `decrypt_in_place*` APIs
by bugzilla_noreply＠suse.com 24 Apr '25

24 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1215657 Bug ID: 1215657 Summary: VUL-0: CVE-2023-42811: rage-encryption: aes-gcm: chosen ciphertext attack via `decrypt_in_place*` APIs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/379692/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: william.brown(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: cunix(a)mail.de, security-team(a)suse.de Depends on: 1215654 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1215654 +++ CVE-2023-42811 aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-42811 https://www.cve.org/CVERecord?id=CVE-2023-42811 https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309 https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1216966] New: cmake 3.27.7 needed to properly support zlib 1.3
by bugzilla_noreply＠suse.com 12 Apr '25

12 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1216966 Bug ID: 1216966 Summary: cmake 3.27.7 needed to properly support zlib 1.3 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: simonf.lees(a)suse.com Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- 3.27.2 which is currently in TW causes: ``` [ 5s] -- Found ZLIB: /usr/lib64/libz.so (found version "1.3.#define ZLIB_VERSION "1.3"") ``` when test building with the 3.27.7 from the devel project. the zlib handling works properly again. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1214789] New: Drop the raw / uncompressed kernel-firmware package
by bugzilla_noreply＠suse.com 08 Apr '25

08 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1214789 Bug ID: 1214789 Summary: Drop the raw / uncompressed kernel-firmware package Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: tiwai(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Currently, kernel-firmware repo provides two different ways of packaging: one is the kernel-firmware.rpm that contains all firmware files in raw and uncompressed format, and another is the split of several subpackages with compressed files which are gathered by kernel-firmwre-all.rpm meta package. The former, kernel-firmware.rpm is still provided only for the legacy use cases (the old SLE), and kernel-firmware-all.rpm already has "Provides: kernel-firmware" as the better (much smaller) replacement. Now, we'd like to drop the old big kernel-firmware.rpm finally. But this needs fixing the dependencies in some package or images. As far as I see, the only package that has an explicit use of the uncompressed files is installation-images. This needs the changes to adapt kernel-firmwre-all and handling of compressed files. Also, KIWI images may have requires of kernel-firmware, and that might be a bigger problem. -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 1213687] New: php8 is broken on RPi
by bugzilla_noreply＠suse.com 07 Apr '25

07 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1213687 Bug ID: 1213687 Summary: php8 is broken on RPi Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868437 --> https://bugzilla.suse.com/attachment.cgi?id=868437&action=edit yast logs I found out that php8 is not useable on RPi compute Module 4 --- rpicompute:~ # zypper info php8 Loading repository data... Reading installed packages... Information for package php8: ----------------------------- Repository : openSUSE-Tumbleweed-Oss Name : php8 Version : 8.2.7-1.1 Arch : aarch64 Vendor : openSUSE Installed Size : 153.9 KiB Installed : Yes Status : up-to-date Source package : php8-8.2.7-1.1.src Upstream URL : https://secure.php.net Summary : Interpreter for the PHP scripting language version 8 Description : PHP is a server-side HTML embedded scripting language designed primarily for web development but also used as a general-purpose programming language. This package contains the base files for all subpackages and must be installed in order to use PHP. Additionally, extension modules and server modules (e.g. for Apache) may be installed. rpicompute:~ # php8 -bash: php8: command not found rpicompute:~ # php8 -m -bash: php8: command not found rpicompute:~ # php8 -v -bash: php8: command not found rpicompute:~ # man php -bash: man: command not found rpicompute:~ # man php8 -bash: man: command not found rpicompute:~ # which php which: no php in (/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/bin:/bin) rpicompute:~ # which php8 which: no php8 in (/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/bin:/bin) -- attache yast logs. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1216366] New: YaST installation with sd-boot: Disabling the menu timeout is not possible
by bugzilla_noreply＠suse.com 07 Apr '25

07 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1216366 Bug ID: 1216366 Summary: YaST installation with sd-boot: Disabling the menu timeout is not possible Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: schubi(a)suse.com Reporter: fvogt(a)suse.com QA Contact: jsrain(a)suse.com CC: yast2-maintainers(a)suse.de Target Milestone: --- Found By: --- Blocker: --- To disable the timeout for the systemd-boot menu, "menu-force" needs to be used, but YaST only allows integer values for the timeout. When -1 is entered, systemd-boot prints an error message that this is an invalid value. Either YaST should explicitly support menu-force or translate -1 to menu-force internally. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1215945] New: ffmpeg-4: Build fails with current Binutils; requires 'asm' fix (15.4, 15.5, Tumbleweed)
by bugzilla_noreply＠suse.com 03 Apr '25

03 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1215945 Bug ID: 1215945 Summary: ffmpeg-4: Build fails with current Binutils; requires 'asm' fix (15.4, 15.5, Tumbleweed) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Keywords: build Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: burnus(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: jengelh(a)inai.de Target Milestone: --- Found By: --- Blocker: --- GNU Binutils 2.41 now reveals a bug in the 'asm' code used in ffmpeg-4: ./libavcodec/x86/mathops.h:125: Error: operand type mismatch for `shr' While Binutils is pending for opensuse:factory, the new version has already landed in 15.4 and 15.5 such that ffmpeg-4 fails there: https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4 ffmpeg-5/6 seemingly got the fix as I do see no fails for 15.4/15.5 for the build of the 4h old package. Upstream FIX: "Fixes assembling with binutil as >= 2.41" at https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/effadce6c756247ea8bae32… See also https://trac.ffmpeg.org/ticket/10405 or (where I found it): The pending Binutils update for openSUSE:factory update is: https://build.opensuse.org/request/show/1113885 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1213370] New: tesseract-ocr should not be built with experimantal opencl support
by bugzilla_noreply＠suse.com 03 Apr '25

03 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1213370 Bug ID: 1213370 Summary: tesseract-ocr should not be built with experimantal opencl support Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: opensuse(a)titlis.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- opencl in tesseract-ocr is considered experimental, according to this thread (https://groups.google.com/g/tesseract-ocr/c/eIQbsurfSEM/m/mVb_4GF1BgAJ) it is considered just an entry point for possible developers. Their own doucmentantion (https://tesseract-ocr.github.io/tessdoc/TesseractOpenCL.html) states: "Important note: OpenCL support in Tesseract is still considered experimental. There are some major bugs associated with it (see issue 837). Building Tesseract with OpenCL support is not recommended (for any version of Tesseract), unless you are a developer and want to improve the OpenCL code" Please remove the flag "--enable-opencl" from https://build.opensuse.org/package/view_file/openSUSE:Factory/tesseract-ocr… This would also resolve https://bugzilla.opensuse.org/show_bug.cgi?id=1207570 PS: I indeed encounter problems with the opencl code path -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1214364] New: net-snmp: new release 5.9.4
by bugzilla_noreply＠suse.com 31 Mar '25

31 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1214364 Bug ID: 1214364 Summary: net-snmp: new release 5.9.4 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: abergmann(a)suse.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- https://github.com/net-snmp/net-snmp/blob/v5.9.4/CHANGES *5.9.4*: IMPORTANT: SNMP over TLS and/or DTLS are not functioning properly in this release with various versions of OpenSSL and will be fixed in a future release. libsnmp: - Remove the SNMP_SWIPE_MEM() macro Remove this macro since it is not used in the Net-SNMP code base. - DISPLAY-HINT fixes - Miscellanious improvements to the transports - Handle multiple oldEngineID configuration lines - fixes for DNS names longer than 63 characters agent: - Added a ignoremount configuration option for the HOST-MIB - disallow SETs with a NULL varbind - fix the --enable-minimalist build apps: - snmpset: allow SET with NULL varbind for testing - snmptrapd: improved MySQL logging code general: - configure: Remove -Wno-deprecated as it is no longer needed - miscellanious ther bug fixes, build fixes and cleanups -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1216083] New: cockpit-ws: theme QA
by bugzilla_noreply＠suse.com 25 Mar '25

25 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1216083 Bug ID: 1216083 Summary: cockpit-ws: theme QA Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: Cockpit-bugs(a)suse.de Reporter: amajer(a)suse.com QA Contact: qa-bugs(a)suse.de CC: Cockpit-bugs(a)suse.de, qa-bugs(a)suse.de Depends on: 1216082 Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1216082 +++ We should add openQA test for basic theme and login -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1217424] New: node-gyp 21 errors out with SyntaxError
by bugzilla_noreply＠suse.com 21 Mar '25

21 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1217424 Bug ID: 1217424 Summary: node-gyp 21 errors out with SyntaxError Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: brunopitrus(a)hotmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After Tumbleweed upgraded to node 21.2.0, the vscode RPM started failing to build with the following error: [ 258s] Traceback (most recent call last): [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/gyp_main.py", line 45, in <module> [ 258s] sys.exit(gyp.script_main()) [ 258s] ^^^^^^^^^^^^^^^^^ [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__.py", line 688, in script_main [ 258s] return main(sys.argv[1:]) [ 258s] ^^^^^^^^^^^^^^^^^^ [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__.py", line 680, in main [ 258s] return gyp_main(args) [ 258s] ^^^^^^^^^^^^^^ [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__.py", line 647, in gyp_main [ 258s] [generator, flat_list, targets, data] = Load( [ 258s] ^^^^^ [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__.py", line 157, in Load [ 258s] result = gyp.input.Load( [ 258s] ^^^^^^^^^^^^^^^ [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/input.py", line 2987, in Load [ 258s] LoadTargetBuildFile( [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/input.py", line 400, in LoadTargetBuildFile [ 258s] build_file_data = LoadOneBuildFile( [ 258s] ^^^^^^^^^^^^^^^^^ [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/input.py", line 237, in LoadOneBuildFile [ 258s] build_file_data = eval(build_file_contents, {"__builtins__": {}}, None) [ 258s] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [ 258s] File "/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/gyp_main.py", line 7 [ 258s] import os [ 258s] ^^^^^^ [ 258s] SyntaxError: invalid syntax see full build log at https://build.opensuse.org/package/live_build_log/devel:tools:ide:vscode/co… This is a regression from nodejs 21.1.0. -- You are receiving this mail because: You are on the CC list for the bug.

1 3