February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1197672] Podman is broken in 20220328
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1197672 https://bugzilla.suse.com/show_bug.cgi?id=1197672#c21 --- Comment #21 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2023:0326-1: An update that solves 6 vulnerabilities, contains one feature and has one errata is now available. Category: security (important) Bug References: 1181640,1181961,1193166,1193273,1197672,1199790,1202809 CVE References: CVE-2021-20199,CVE-2021-20206,CVE-2021-4024,CVE-2021-41190,CVE-2022-27649,CVE-2022-2989 JIRA References: PED-2771 Sources used: openSUSE Leap Micro 5.2 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Server for SAP 15-SP3 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Server 15-SP3-LTSS (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Micro 5.2 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Micro 5.1 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src): podman-4.3.1-150300.9.15.1 SUSE Enterprise Storage 7.1 (src): podman-4.3.1-150300.9.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193273] VUL-1: CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1193273 https://bugzilla.suse.com/show_bug.cgi?id=1193273#c17 --- Comment #17 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2023:0326-1: An update that solves 6 vulnerabilities, contains one feature and has one errata is now available. Category: security (important) Bug References: 1181640,1181961,1193166,1193273,1197672,1199790,1202809 CVE References: CVE-2021-20199,CVE-2021-20206,CVE-2021-4024,CVE-2021-41190,CVE-2022-27649,CVE-2022-2989 JIRA References: PED-2771 Sources used: openSUSE Leap Micro 5.2 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Server for SAP 15-SP3 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Server 15-SP3-LTSS (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Micro 5.2 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise Micro 5.1 (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src): podman-4.3.1-150300.9.15.1 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src): podman-4.3.1-150300.9.15.1 SUSE Enterprise Storage 7.1 (src): podman-4.3.1-150300.9.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207378] VUL-0: CVE-2022-48279: apache2-mod_security2, modsecurity: HTTP multipart requests incorrectly parsed and could bypass the Web Application Firewall
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207378 https://bugzilla.suse.com/show_bug.cgi?id=1207378#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2023:0318-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1207378 CVE References: CVE-2022-48279 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): apache2-mod_security2-2.8.0-7.6.1 SUSE OpenStack Cloud 9 (src): apache2-mod_security2-2.8.0-7.6.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): apache2-mod_security2-2.8.0-7.6.1 SUSE Linux Enterprise Server 12-SP5 (src): apache2-mod_security2-2.8.0-7.6.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): apache2-mod_security2-2.8.0-7.6.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): apache2-mod_security2-2.8.0-7.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207378] VUL-0: CVE-2022-48279: apache2-mod_security2, modsecurity: HTTP multipart requests incorrectly parsed and could bypass the Web Application Firewall
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207378 https://bugzilla.suse.com/show_bug.cgi?id=1207378#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2023:0314-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1207378 CVE References: CVE-2022-48279 JIRA References: Sources used: openSUSE Leap 15.4 (src): apache2-mod_security2-2.9.4-150400.3.3.1 SUSE Linux Enterprise Module for Server Applications 15-SP4 (src): apache2-mod_security2-2.9.4-150400.3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202732] Update NUT version to v2.8.0 released on April'22
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1202732 https://bugzilla.suse.com/show_bug.cgi?id=1202732#c5 --- Comment #5 from Petr Gajdos <pgajdos(a)suse.com> --- (In reply to Thomas Renninger from comment #3) > @Petr: A minor nit-pick: Hm, not sure if the bot finally works for non-SLE > projects, if you add bsc#1202732 to the changelog, there might be > notification here. > I am closing this as Petr's request hit factory some days ago: > https://build.opensuse.org/package/show/openSUSE:Factory/nut Thanks @Thomas. I am just a coordinator here. So kudos go to Arjen Korte who did the request actually. Also, the request was independent on this bug, it was just a coincidence, that is why it is not included in the change log. While this is openSUSE Tumbleweed bug, I guess the bug reference do not necessarily need to hit changelog even for SLE needs. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202732] Update NUT version to v2.8.0 released on April'22
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1202732 https://bugzilla.suse.com/show_bug.cgi?id=1202732#c4 --- Comment #4 from Arjen de Korte <suse+build(a)de-korte.org> --- @Thomas: you're barking up the wrong tree here, as it wasn't Petr who submitted this request. I'll try to include this in the ChangLog entry in the future. He did a test of the updated package though, so credit where credit is due. I didn't realise there was a bugzilla entry for this when I submitted the update. I was trying to fix this, as NUT failed to build in Factory for a couple of weeks already and was about to hit Dominique's axe for failing to build for more than four weeks. As a retired core developer for NUT, I felt this was the least I could do. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207378] VUL-0: CVE-2022-48279: apache2-mod_security2, modsecurity: HTTP multipart requests incorrectly parsed and could bypass the Web Application Firewall
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207378 https://bugzilla.suse.com/show_bug.cgi?id=1207378#c7 --- Comment #7 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2023:0317-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1207378 CVE References: CVE-2022-48279 JIRA References: Sources used: SUSE Manager Server 4.2 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Manager Retail Branch Server 4.2 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Manager Proxy 4.2 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise Server for SAP 15-SP3 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise Server 15-SP3-LTSS (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise Realtime Extension 15-SP3 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Enterprise Storage 7.1 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Enterprise Storage 7 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE Enterprise Storage 6 (src): apache2-mod_security2-2.9.2-150000.3.6.1 SUSE CaaS Platform 4.0 (src): apache2-mod_security2-2.9.2-150000.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208101] New: mount=ordered not shown on ext4 root filesystem in /proc/self/mounts
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208101 Bug ID: 1208101 Summary: mount=ordered not shown on ext4 root filesystem in /proc/self/mounts Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: openSUSE Leap 15.3 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: david(a)dgreaves.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Running a 15.3 kvm client (hostname bsfe) on an openSuse 15.3 host kvm and host kernels are 5.3.18-150300.59.106-default The root filesystem is supposed to have data=ordered bsfe:~ # grep vda /etc/fstab /dev/vda / ext4 rw,noatime,user_xattr,acl,barrier=1,data=ordered 0 1 Both /proc/self/mountinfo and /proc/self/mounts do not show data=ordered bsfe:~ # grep vda /proc/self/mountinfo 96 1 254:0 / / rw,noatime shared:1 - ext4 /dev/vda rw,stripe=32 bsfe:~ # grep vda /proc/mounts /dev/vda / ext4 rw,noatime,stripe=32 0 0 The kernel messages show the options during mount like so: bsfe:~ # dmesg | grep vda | grep ordered [ 3.209441] EXT4-fs (vda): mounted filesystem with ordered data mode. Opts: (null) [ 3.648673] EXT4-fs (vda): re-mounted. Opts: user_xattr,acl,barrier=1,data=ordered The options in /proc/fs/ext4 DOES show data=ordered which I *think* means that the device is currently mounted with data=ordered. bsfe:~ # grep ordered /proc/fs/ext4/vda/options data=ordered Another filesystem does show this correctly/consistently: bbsfe:~ # grep vdc /etc/fstab /dev/vdc /var ext4 rw,noatime,user_xattr,acl,barrier=1,data=ordered 0 2 sfe:~ # grep vdc /proc/mounts /dev/vdc /var ext4 rw,noatime,stripe=32,data=ordered 0 0 bsfe:~ # grep vdc /proc/self/mountinfo 120 96 254:32 / /var rw,noatime shared:65 - ext4 /dev/vdc rw,stripe=32,data=ordered bsfe:~ # dmesg | grep vdc | grep ordered [ 3.804751] EXT4-fs (vdc): mounted filesystem with ordered data mode. Opts: user_xattr,acl,barrier=1,data=ordered bsfe:~ # grep ordered /proc/fs/ext4/vdc/options data=ordered In case it's useful : The vdX devices are mapped from an lvm over raid6 on the host libvirt boots directly into the kernel without a bootloader: <os> <type arch='x86_64' machine='pc-q35-2.9'>hvm</type> <kernel>/kvmboot/bsfe/vmlinuz-5.3.18-150300.59.106-default</kernel> <initrd>/kvmboot/bsfe/initrd-5.3.18-150300.59.106-default</initrd> <cmdline>root=/dev/vda read-only console=ttyS0 net.ifnames=0 biosdevname=0</cmdline> <boot dev='fd'/> </os> -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202732] Update NUT version to v2.8.0 released on April'22
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1202732 https://bugzilla.suse.com/show_bug.cgi?id=1202732#c3 Thomas Renninger <trenn(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |trenn(a)suse.com Resolution|--- |FIXED --- Comment #3 from Thomas Renninger <trenn(a)suse.com> --- @Petr: A minor nit-pick: Hm, not sure if the bot finally works for non-SLE projects, if you add bsc#1202732 to the changelog, there might be notification here. I am closing this as Petr's request hit factory some days ago: https://build.opensuse.org/package/show/openSUSE:Factory/nut Thanks a lot for doing this! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1206421] libvulkan_intel-32bit isn't installed automatically with wine
by bugzilla_noreply＠suse.com 09 Feb '23

09 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1206421 https://bugzilla.suse.com/show_bug.cgi?id=1206421#c5 --- Comment #5 from Stefan Dirsch <sndirsch(a)suse.com> --- Yes, you can. libvulkan_intel/libvulkan_intel-32bit only exists on %ix86/x86_64, but hey - we're talking about Wine. ;-) libvulkan_radeon/libvulkan_radeon-32bit also exists on %arm/aarch64/riscv64, but I guess this is not relevant for Wine. ;-) Of course the -32bit packages have dependancies to other -32bit libraries, but I guess this is no news when you install Wine either. ;-) -- You are receiving this mail because: You are on the CC list for the bug.

1 0