February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1208637] New: VUL-0: CVE-2022-2119: dcmtk: path traversal vulnerability
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208637 Bug ID: 1208637 Summary: VUL-0: CVE-2022-2119: dcmtk: path traversal vulnerability Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/335512/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: kde-maintainers(a)suse.de Reporter: gabriele.sonnu(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: Security Response Team Blocker: --- OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2119 https://bugzilla.redhat.com/show_bug.cgi?id=2173038 https://www.cve.org/CVERecord?id=CVE-2022-2119 https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1207827] Can not install opensuse tumbleweed in second nvme - issue after kernel 5.15 LTS
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207827 https://bugzilla.suse.com/show_bug.cgi?id=1207827#c16 Daniel Wagner <daniel.wagner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED Flags|needinfo?(freitasmgustavo@g | |mail.com) | --- Comment #16 from Daniel Wagner <daniel.wagner(a)suse.com> --- The TW kernel update to 6.2 will ships the patch. I've also applied to the sle15sp5. All other kernels do not have the function which checks duplicated NSID. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208634] VUL-0: CVE-2022-47516: sofia-sip: remote DoS via crafted UDP message
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208634 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208634] VUL-0: CVE-2022-47516: sofia-sip: remote DoS via crafted UDP message
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

1 0

[Bug 1208633] New: sftp fails out of the box with minimial vm
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208633 Bug ID: 1208633 Summary: sftp fails out of the box with minimial vm Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: william.brown(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- After installing a new tumbleweed minimal vm it is not possible to sftp from the machine. The ssh client states: subsystem request failed on channel 0 scp: Connection closed The server logs: Feb 24 13:56:54 yas-78 sshd[2156]: subsystem request for sftp by user admin failed, subsystem not found # cat /etc/*release NAME="openSUSE Tumbleweed" # VERSION="20230222" openssh-server-8.9p1-7.2.x86_64 openssh-8.9p1-7.2.x86_64 yas-78:/home/admin # less /usr/etc/ssh/sshd_config # override default of no subsystems Subsystem sftp /usr/libexec/ssh/sftp-server -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1208567] qemu-system-x86_64: Failed to lock byte 100
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208567 https://bugzilla.suse.com/show_bug.cgi?id=1208567#c9 William Brown <william.brown(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(william.brown@sus | |e.com) | --- Comment #9 from William Brown <william.brown(a)suse.com> --- (In reply to David Disseldorp from comment #6) > (In reply to David Disseldorp from comment #5) > > (In reply to David Disseldorp from comment #3) > > ... > > > Putting it on my queue. My initial impression is that some changes to > > > virt-aa-helper are needed to permit the file locking. > > > > Actually, it looks like what's needed here is a follow up to the boo#1203976 > > 7aec69b7-apparmor-Fix-QEMU-access-for-UEFI.patch which permits locking of > > qemu-ovmf-x86_64 paths installed under /usr/share/qemu/ovmf-*.bin . It looks > > as though this edk2/OVMF path is somewhat SUSE-unique, which would explain > > why this didn't make it into the upstream profile. > > @William: please try manually changing the profile at > /etc/apparmor.d/abstractions/libvirt-qemu : > > @@ -90,7 +90,7 @@ > /usr/share/proll/** r, > /usr/share/qemu-efi/** r, > /usr/share/qemu-kvm/** r, > - /usr/share/qemu/** r, > + /usr/share/qemu/** rk, > /usr/share/seabios/** r, > /usr/share/sgabios/** r, > /usr/share/slof/** r, > > Then as root reload the profile (reload of all profiles is probably easiest): > Will this prevent successful upgrading of the profile in future though? That file is owned by libvirt-daemon-8.0.0-150400.7.3.1.x86_64, and is listed as a config file meaning that if I modify it, rpm will no longer alter or upgrade the content going forward. So I think i'd rather just wait for an update. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208616] Unable to boot on encrypted RAID 1 Btrfs install
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208616 https://bugzilla.suse.com/show_bug.cgi?id=1208616#c5 Kelvin Hu <hukelvin99(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #865091|0 |1 is obsolete| | --- Comment #5 from Kelvin Hu <hukelvin99(a)gmail.com> --- Created attachment 865102 --> https://bugzilla.suse.com/attachment.cgi?id=865102&action=edit RAID 1 settings enabled explicitly It looks like the default RAID level for both data and metadata is dependent on disk configuration. I've performed the same steps again while explicitly setting to RAID 1 for both. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1177260] Switching python-numpy to plain BLAS causes significant performance regression
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1177260 https://bugzilla.suse.com/show_bug.cgi?id=1177260#c42 --- Comment #42 from Stefan Br�ns <stefan.bruens(a)rwth-aachen.de> --- (In reply to Egbert Eich from comment #29) > @Stefan Br�ns: I've finally fixed what you've suggested in comment #4 - all > flavors of OpenBLAS use the same SONAME so they can be used as plug-in > replacements. > You can find this in my home on OBS: home:eeich:branches:science/openblas - > this also contains some cleanups. If I don't hear any objections I will > submit it and later on push it to Factory. > > What hasn't been done, yet, is to combine the lapack[e] & [c]blas libraries > to a block as you've suggested in comment #11. This would again require to > touch lapack and openblas. This broke building for a lot of packages in SLE/Leap in the science project, as numpy is not build with the changed SONAME, and thus becomes unresolvable (the openblas from the science project shadows the package from the regular repository). IMHO, this is an ABI breakage which has to be conditional. Only SLE/Leap 16/ALP should use the new name (and TW, of course). For the time being, I have disabled openblas' "use_for_build" for Leap 15.4. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1177260] Switching python-numpy to plain BLAS causes significant performance regression
by bugzilla_noreply＠suse.com 24 Feb '23

24 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1177260 https://bugzilla.suse.com/show_bug.cgi?id=1177260#c41 --- Comment #41 from Stefan Br�ns <stefan.bruens(a)rwth-aachen.de> --- (In reply to Egbert Eich from comment #39) > Ok, then the reason why the CBLAS-enabled numpy version was lost was that > Leap acquired the python packages from SLE - where we obviously weren't able > to build against it. > The first step towards this would be to update Lapack on SLE to a version > that provides CBLAS. Originally, numpy used the cblas from openblas, so this did not matter. Only when numpy changed from openblas to netlib-lapack (@3.5.0), the missing cblas became a problem. For numpy + cblas, there are two options: 1. Build numpy as part of Backports, which already *has* cblas. 2. Bring an updated lapack (>= 3.6.0) to SLE. But as far as I understand, this *also* goes into backports only, so we also need to build numpy in backports. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208627] New: python3-podman errors ModuleNotFoundError: No module named 'xdg.BaseDirectory'
by bugzilla_noreply＠suse.com 23 Feb '23

23 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208627 Bug ID: 1208627 Summary: python3-podman errors ModuleNotFoundError: No module named 'xdg.BaseDirectory' Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: david.mulder(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I installed python3-podman, then tried importing it, and got this: >>> import podman Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python3.10/site-packages/podman/__init__.py", line 6, in <module> from podman.client import PodmanClient, from_env File "/usr/lib/python3.10/site-packages/podman/client.py", line 8, in <module> import xdg.BaseDirectory ModuleNotFoundError: No module named 'xdg' >>> python310-xdg wasn't installed, so I installed it: >>> import podman Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python3.10/site-packages/podman/__init__.py", line 6, in <module> from podman.client import PodmanClient, from_env File "/usr/lib/python3.10/site-packages/podman/client.py", line 8, in <module> import xdg.BaseDirectory ModuleNotFoundError: No module named 'xdg.BaseDirectory' >>> At a minimum, python3-podman clearly needs python3-xdg added as a BuildRequires, but something else is still missing here (maybe there's an issue with the version of python3-xdg?) -- You are receiving this mail because: You are on the CC list for the bug.

1 1