February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1182095] VUL-0: CVE-2021-26939: phpMyAdmin: attacker can dump phpMyAdmin SQL content
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1182095 https://bugzilla.suse.com/show_bug.cgi?id=1182095#c3 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-team@sus | |e.de) | --- Comment #3 from Marcus Meissner <meissner(a)suse.com> --- was done -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1176227] VUL-1: CVE-2020-24979: bison: buffer overflow in src/symtab.c
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1176227 https://bugzilla.suse.com/show_bug.cgi?id=1176227#c3 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-team@sus | |e.de) | --- Comment #3 from Marcus Meissner <meissner(a)suse.com> --- isdone -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207498] New: Nothing provides libquazip1-qt5.so.1.3.0 for krita
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207498 Bug ID: 1207498 Summary: Nothing provides libquazip1-qt5.so.1.3.0 for krita Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: mzamenski_dev(a)inbox.eu QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 864392 --> http://bugzilla.opensuse.org/attachment.cgi?id=864392&action=edit Photo When I run "sudo zypper in krita", it states "Problem: nothing provides 'libquazip1-qt5.so.1.3.0()(64bit)' needed by the to be installed krita-5.1.5-1.2.x86_64". Krita used to work on tumbleweed so I assume this is a bug as libquazip1-qt5.so.1.4.0 is installed. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1207734] AMDGPU related freeze when returning from monitor powersave
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207734 http://bugzilla.opensuse.org/show_bug.cgi?id=1207734#c2 --- Comment #2 from Matti Kettunen <matti.kettunen(a)gmail.com> --- (In reply to Takashi Iwai from comment #1) > I'm building a test kernel with the possible upstream fix patch. > Please give it a try later. Powersave works perfectly with kernel 5.14.21-150400.1.g8c84ccd-default. Also waking up from suspend works properly although I had to power off/on my monitor before login screen was visible but I think it's more likely to be monitor problem than kernel/amdgpu problem. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1041742] transfiletriggerin and transfiletriggerpostun are not executed by libzypp
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1041742 https://bugzilla.suse.com/show_bug.cgi?id=1041742#c33 --- Comment #33 from Michael Andres <ma(a)suse.com> --- (In reply to Martin Wilck from comment #32) > Why not? There were no options to prevent rpm from executing the triggers and for libzypp to query the triggers and to compute which triggers would have been executed, if all packages would have been executed in a single rpm transaction. That's why we implemented an install mode that uses a single transaction completely driven by rpm. Posttrans OTOH is comparably easy because we can query the script and there is no condition(trigger) tied to it's execution. ZYPP_SINGLE_RPMTRANS should be propagated and established as new default. Even for SLE/Leap. Amending the traditional install would meanwhile be possible by using a patched rpm. But this is not yet tested and it bears a high risk to break existing packages and workflows. All trigger scripts would move to different locations within the whole transaction. This may break things and if this happens at the customers side there is no fallback. Unlike a rpm transaction, which can not be interrupted by Ctrl-C e.g., the traditional installer can be interrupted between packages. In some modes (downloas-as-needed) it even performs alternating downloads and installs. So we would not even be able to offer the 'fix' in all modes. Not talking about of all the risks when having to recover from an error within the install. SINGLE_RPMTRANS solves all this 'for free'. With ZYPP_SINGLE_RPMTRANS we have the mode we'd like to harden and establish as future default. It has different prereqs and behaviour, for example enforcing download in advance, not being interruptible. Even if you'd kill zypper/YAST, the rpm transaction will continue like rpm itself would. The traditions install could stay as fallback if actually needed somwhere. If we try to offer some solution for the traditional install, it would be a 3rd workflow somewhere in the middle of the above two. Something half-baked. Our goal is to get rid of the traditional install, and not to maintain 2 install favors. That's why we made SINGLE_RPMTRANS availabkle in whole SLE-15 (GA-SP5). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207562] U-Boot: Raspberry Pi 4 booting from USB stopped booting
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207562 Matthias Brugger <mbrugger(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |ivan.ivanov(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1182554] New: cannot start greetd.service .... missing PAM module
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1182554 Bug ID: 1182554 Summary: cannot start greetd.service .... missing PAM module Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Enhancement Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mcepl(a)suse.com QA Contact: qa-bugs(a)suse.de CC: denis.kondratenko(a)suse.com, mcepl(a)suse.com, opensuse(a)trummer.xyz, stdden(a)opensuse.org Found By: --- Blocker: --- Created attachment 846366 --> https://bugzilla.suse.com/attachment.cgi?id=846366&action=edit journalctl -xb output When trying to replace gdm with greetd following the steps on https://en.opensuse.org/Portal:OpenSUSEway, greetd fails to start and journal shows: �no 22 09:38:10 stitny greetd[2347]: error: PAM 'greetd' service missing When looking around, there is the file /usr/etc/pam.d/greetd with this content: ~@stitny$ cat /usr/etc/pam.d/greetd #%PAM-1.0 auth requisite pam_nologin.so auth include common-auth account include common-account password include common-password session required pam_loginuid.so session optional pam_keyinit.so force revoke session include common-session ~@stitny$ but I have still /etc/pam.d/ as well and there is no greetd file. Which one is used? -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1207853] D-Installer cannot build in s390x because of missing fbcon module
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207853 https://bugzilla.suse.com/show_bug.cgi?id=1207853#c2 Martin Wilck <martin.wilck(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(ihno(a)suse.com) --- Comment #2 from Martin Wilck <martin.wilck(a)suse.com> --- We pull in fbcon as soft-dep of virtio_gpu on request of IBM, as a result of bug 1121996. This is done via modprobe.d, the respective file is maintained in suse-module-tools as a s390x-specific configuration file. But since 6104c37094e7 ("fbcon: Make fbcon a built-time depency for fbdev", upstream 4.14), fbcon is not a separate module any more. This affects SLE15-SP2 and later (5.3.18, 5.14.21) and of course, Factory. modprobe handles this gracefully as long as only virtio_gpu is loaded; it just skips the softdep. But the suse-initrd dracut module throws an error trying to copy the fbcon module into the initramfs. @Ihno, I will just drop this dependency. I believe it has simply become obsolete. fbcon is now part of the "fb" module. The availablity of the console (CONFIG_FRAMEBUFFER_CONSOLE=y) is set at kernel build-time, in all our relevant kernel branches. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207853] D-Installer cannot build in s390x because of missing fbcon module
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207853 https://bugzilla.suse.com/show_bug.cgi?id=1207853#c1 Martin Wilck <martin.wilck(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS CC| |ihno(a)suse.com --- Comment #1 from Martin Wilck <martin.wilck(a)suse.com> --- > It could be related to (https://github.com/openSUSE/suse-module-tools/pull/7) Yes it is. See bug 1121996. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202933] VUL-0: CVE-2022-3560: pesign: pesign-authorize ExecStartPost script allows privilege escalation from pesign to root
by bugzilla_noreply＠suse.com 02 Feb '23

02 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1202933 https://bugzilla.suse.com/show_bug.cgi?id=1202933#c19 Gary Ching-Pang Lin <glin(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(glin(a)suse.com) | --- Comment #19 from Gary Ching-Pang Lin <glin(a)suse.com> --- (In reply to Matthias Gerstner from comment #18) > (In reply to Matthias Gerstner from comment #1) > > c) we need to fix the broken systemd hardening in Tumbleweed > > d) we need to fix the broken paths in SLE-15 > > > > c) and d) should only be done after the fixes are applied, lest we actually > > introduce the vulnerability in 2). > > Thanks for handling the fix! > > Do you also take care of these issues? Sure. It's a part of my plan. -- You are receiving this mail because: You are on the CC list for the bug.

1 0