February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1203190] New: VUL-1: CVE-2022-35931: nextcloud: Password Policy app could generate passwords that would be block
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1203190 Bug ID: 1203190 Summary: VUL-1: CVE-2022-35931: nextcloud: Password Policy app could generate passwords that would be block Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/341558/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2022-35931 Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-35931 https://www.cve.org/CVERecord?id=CVE-2022-35931 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c… https://github.com/nextcloud/password_policy/pull/363 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1207976] New: VUL-0: CVE-2023-23942: nextcloud-desktop: missing sanitisation on qml labels leading to javascript injection
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207976 Bug ID: 1207976 Summary: VUL-0: CVE-2023-23942: nextcloud-desktop: missing sanitisation on qml labels leading to javascript injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/356329/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2023-23942 The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23942 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… https://www.cve.org/CVERecord?id=CVE-2023-23942 https://github.com/nextcloud/desktop/pull/5233 https://hackerone.com/reports/1788598 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1201070] New: Tumbleweed 20220629: can't install nextcloud-desktop
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1201070 Bug ID: 1201070 Summary: Tumbleweed 20220629: can't install nextcloud-desktop Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: Mathias.Homann(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I'm trying to install the nextcloud desktop client on TW 20220629 but it fails with dependency issues: twvm:~ # zypper in nextcloud-desktop Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides 'libQt5Gui.so.5(Qt_5.15.2_PRIVATE_API)(64bit)' needed by the to be installed nextcloud-desktop-3.5.1-1.1.x86_64 Solution 1: do not install nextcloud-desktop-3.5.1-1.1.x86_64 Solution 2: break nextcloud-desktop-3.5.1-1.1.x86_64 by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c/d/?] (c): c twvm:~ # cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20220629" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20220629" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:tumbleweed:20220629" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo-Tumbleweed" on TW 20220628 it installs ok. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1207978] New: VUL-0: CVE-2023-23944: nextcloud: user's passwordsstored in cleartext in the database during the duration of OAuth2 setup procedure
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207978 Bug ID: 1207978 Summary: VUL-0: CVE-2023-23944: nextcloud: user's passwordsstored in cleartext in the database during the duration of OAuth2 setup procedure Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/356232/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2023-23944 Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23944 https://github.com/nextcloud/mail/pull/7797 https://www.cve.org/CVERecord?id=CVE-2023-23944 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g… https://hackerone.com/reports/1806275 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1207977] New: VUL-0: CVE-2023-23943: nextcloud: IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207977 Bug ID: 1207977 Summary: VUL-0: CVE-2023-23943: nextcloud: IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/356328/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2023-23943 Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23943 https://www.cve.org/CVERecord?id=CVE-2023-23943 https://github.com/nextcloud/mail/pull/7796 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8… https://hackerone.com/reports/1741525 https://hackerone.com/reports/1736390 https://hackerone.com/reports/1746582 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1200511] New: evince keeps crashing
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1200511 Bug ID: 1200511 Summary: evince keeps crashing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: wardlawhunter(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am getting consistent crashes from evince when trying to view a pdf. If I scroll or page down through this pdf about 10 pages it will reliably crash. The terminal produces the following error output after crashing: evince: cairo-error.c:68: _cairo_error: Assertion `_cairo_status_is_error (status)' failed. Aborted (core dumped) -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1189907] New: gnome-software: packages from the main distro repository should not be marked as potentially dangerous
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1189907 Bug ID: 1189907 Summary: gnome-software: packages from the main distro repository should not be marked as potentially dangerous Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- it should work more like software.o.o categorizes packages. i think the main culprit might be that it doesnt have any permissions information like it has for flatpak based apps. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1204564] New: Nautilus is laggy and slow on GNOME 43
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1204564 Bug ID: 1204564 Summary: Nautilus is laggy and slow on GNOME 43 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: sfalken(a)cloverleaf-linux.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Nautilus is slow to generate thumbnails and list directories in current GNOME 43. Through investigation, it appears that at-spi2-core is not being installed along with Nautilus. Installing it manually results in Nautilus generating thumbnails and directory previews much faster, as expected. I suggest at-spi2-core should be added perhaps as a Recommends: for Nautilus? -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1088738] New: xhost setting fails to have affect in /etc/gdm/Xsession --- "no protocol specified"
by bugzilla_noreply＠novell.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1088738 Bug ID: 1088738 Summary: xhost setting fails to have affect in /etc/gdm/Xsession --- "no protocol specified" Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: GNOME Assignee: bnc-team-gnome(a)forge.provo.novell.com Reporter: noah(a)chromakey.io QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- line 154 xhost+ si:localuser ... needs to be in /etc/X11/xinit/xinitrc.d/what-ever.sh ... ... or maybe somewhere else all I know is that in Xsession it fails to have any affect ... effectively breaking the X11 gnome access for remote logins/ssh/etc. I'd expect a lot of bug reports of people angry, confused .. and complaining about "no protocol specified" errors. Thanks! -noah -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1208117] New: Teach kernel-scriptlets/rpm-script about systemd-boot
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1208117 Bug ID: 1208117 Summary: Teach kernel-scriptlets/rpm-script about systemd-boot Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- rpm-script shell script has: run_bootloader () { if [ -f /etc/sysconfig/bootloader ] && [ -f /boot/grub/menu.lst -o \ -f /etc/lilo.conf -o \ -f /etc/elilo.conf -o \ -f /etc/zipl.conf -o \ -f /etc/default/grub ] then return 0 else return 1 fi } If we want to support systemd-boot as bootloader, the hard-coded list of bootloader config files needs to be updated. However at a first glance it would have been better if `run_bootloader()` didn't make any assumption on the supported bootloaders and let /usr/lib/bootloader/bootloader_entry figure out itself what to do with the current installation. -- You are receiving this mail because: You are on the CC list for the bug.

1 6