February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1208557] New: VUL-0: CVE-2022-31394: fractal: hyper: max header list size not settable allowing deny of service
by bugzilla_noreply＠suse.com 22 Feb '23

22 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208557 Bug ID: 1208557 Summary: VUL-0: CVE-2022-31394: fractal: hyper: max header list size not settable allowing deny of service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/357841/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: os.gnome.maintainers(a)gmail.com Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de CC: security-team(a)suse.de Blocks: 1208551 Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1208551 +++ CVE-2022-31394 Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31394 https://www.cve.org/CVERecord?id=CVE-2022-31394 https://github.com/hyperium/hyper/compare/v0.14.18...v0.14.19 https://github.com/hyperium/hyper/issues/2826 https://github.com/hyperium/hyper/pull/2828 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1208535] New: sushi pulls older webkit2gtk which makes livecd too big
by bugzilla_noreply＠suse.com 22 Feb '23

22 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208535 Bug ID: 1208535 Summary: sushi pulls older webkit2gtk which makes livecd too big Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- webkit2gtk 4.1 is pulled in by sushi, which got updated to 43.0 in https://build.opensuse.org/request/show/1011861 Fabian was considering downgrade the version, as otherwise we pull two versions of webkit2gtk. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1206230] New: [Build 20221207] ibus installation: not all expected variables exported
by bugzilla_noreply＠suse.com 22 Feb '23

22 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1206230 Bug ID: 1206230 Summary: [Build 20221207] ibus installation: not all expected variables exported Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/2937078/modules/ibus _installation/steps/33 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: openQA Blocker: Yes ## Observation The current QA test installs ibus, reboots and expects a number of variables to be export: INPUT_METHOD XMODIFIERS QT_IM_MODULE Since this snapshot though, only INPUT_METHOD is defined. openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-gnome-x11-ibus@64bit fails in [ibus_installation](https://openqa.opensuse.org/tests/2937078/modules/ibus_i… ## Test suite description ## Reproducible Fails since (at least) Build [20220831](https://openqa.opensuse.org/tests/2602873) ## Expected result Last good: [20210810](https://openqa.opensuse.org/tests/1873689) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1208547] New: Alternatives error in python310-docutils-0.19-3.2.noarch.rpm
by bugzilla_noreply＠suse.com 22 Feb '23

22 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208547 Bug ID: 1208547 Summary: Alternatives error in python310-docutils-0.19-3.2.noarch.rpm Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: ro.webbdg(a)gmail.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Overview: 'zypper dup' exited with error code 107 due to the %post install scriptlet of python310-docutils-0.19-3.2.noarch failing. Steps to Reproduce: zypper in -f python310-docutils-0.19-3.2.noarch Actual Results (output from above command): Loading repository data... Reading installed packages... Forcing installation of 'python310-docutils-0.19-3.2.noarch' from repository 'Main Repository (OSS)'. Resolving package dependencies... The following package is going to be reinstalled: python310-docutils 1 package to reinstall. Overall download size: 0 B. Already cached: 1.6 MiB. No additional space will be used or freed after the operation. Continue? [y/n/v/...? shows all options] (y): In cache python310-docutils-0.19-3.2.noarch.rpm (1/1), 1.6 MiB Checking for file conflicts: .............................................[done] update-alternatives: error: alternative rst2html can't be slave of docutils: it is a master alternative warning: %post(python310-docutils-0.19-3.2.noarch) scriptlet failed, exit status 2 (1/1) Installing: python310-docutils-0.19-3.2.noarch .....................[done] poppies:/home/robert/t/bug/zypper/dup/20230220/r # Expected Results: Same as above, but without the error and warning. Build Date & Hardware: openSUSE Tumbleweed 20230219-0 x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1208444] 20230216-0 release hardlock
by bugzilla_noreply＠suse.com 22 Feb '23

22 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208444 https://bugzilla.suse.com/show_bug.cgi?id=1208444#c7 --- Comment #7 from Scott Bradnick <scott.bradnick(a)suse.com> --- (In reply to Scott Bradnick from comment #6) > (In reply to Scott Bradnick from comment #5) > > Seems like this _could_ be a [repeat of a prior] kernel issue, changing the > > Component. > > Much like bsc1206683 and this issue, I installed the latest from > Kernel:stable and the system boots to the login screen w/o the hardlock. > > Currently running on 6.2.0-4.1.g89e2785 and as long as it runs for the next > few hours w/o issue(s) I'll clear the lock for ucode-intel and see how that > goes. No issues w/ ucode-intel unlocked/updated. I was able to install nvidia[_drm] from the 525.89.02 .run file and it works fine. Also built the 8852au wireless driver from https://github.com/lwfinger/rtl8852au.git with this kernel w/o issue; not currently using the device, but I like to make sure it [still] builds. Not sure what's up (or missing) from 6.1.12, but it seems like 6.2.0 resolves the problem. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208525] New: devel:languages:rust/rustup: Bug
by bugzilla_noreply＠suse.com 22 Feb '23

22 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208525 Bug ID: 1208525 Summary: devel:languages:rust/rustup: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: federico(a)suse.com Reporter: c.schmidler(a)finvia.fo QA Contact: screening-team-bugs(a)suse.de CC: alarrosa(a)suse.com, aplanas(a)suse.com, william.brown(a)suse.com Found By: --- Blocker: --- In Revision 32 a previous change from Revision 28 was reverted: Adding 'rust-analyzer' to the `DUP_TOOLS` in the `lib.rs`. This prevents executing `rust-analyzer` as proxy. In the upstream this change did not happen. Could this be corrected again? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1208444] 20230216-0 release hardlock
by bugzilla_noreply＠suse.com 21 Feb '23

21 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208444 https://bugzilla.suse.com/show_bug.cgi?id=1208444#c6 --- Comment #6 from Scott Bradnick <scott.bradnick(a)suse.com> --- (In reply to Scott Bradnick from comment #5) > Seems like this _could_ be a [repeat of a prior] kernel issue, changing the > Component. Much like bsc1206683 and this issue, I installed the latest from Kernel:stable and the system boots to the login screen w/o the hardlock. Currently running on 6.2.0-4.1.g89e2785 and as long as it runs for the next few hours w/o issue(s) I'll clear the lock for ucode-intel and see how that goes. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208478] New: tigervnc embeds random RSA key
by bugzilla_noreply＠suse.com 21 Feb '23

21 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208478 Bug ID: 1208478 Summary: tigervnc embeds random RSA key Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: joan.torres(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: sndirsch(a)suse.com Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our tigervnc package does not build reproducibly because it embeds a private key with timestamps in its .jar --- old /usr/share/vnc/classes/VncViewer.jar/META-INF/TIGERVNC.RSA (hex) +++ new /usr/share/vnc/classes/VncViewer.jar/META-INF/TIGERVNC.RSA (hex) @@ -1,8 +1,8 @@ 000000c0 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e |tware Developmen| 000000d0 74 31 11 30 0f 06 03 55 04 03 13 08 54 69 67 65 |t1.0...U....Tige| 000000e0 72 56 4e 43 30 1e 17 0d 32 33 30 32 31 39 30 39 |rVNC0...23021909| -000000f0 35 31 32 30 5a 17 0d 34 33 30 32 31 34 30 39 35 |5120Z..430214095| -00000100 31 32 30 5a 30 7f 31 0b 30 09 06 03 55 04 06 13 |120Z0.1.0...U...| +000000f0 35 32 34 33 5a 17 0d 34 33 30 32 31 34 30 39 35 |5243Z..430214095| +00000100 32 34 33 5a 30 7f 31 0b 30 09 06 03 55 04 06 13 |243Z0.1.0...U...| 00000110 02 55 53 31 0e 30 0c 06 03 55 04 08 13 05 54 65 |.US1.0...U....Te| 00000120 78 61 73 31 0f 30 0d 06 03 55 04 07 13 06 41 75 |xas1.0...U....Au| 00000130 73 74 69 6e 31 1d 30 1b 06 03 55 04 0a 13 14 54 |stin1.0...U....T| Is that key used? And for what? -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1184608] New: mono-core depends on mono-devel
by bugzilla_noreply＠suse.com 21 Feb '23

21 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1184608 Bug ID: 1184608 Summary: mono-core depends on mono-devel Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Mono Assignee: bnc-team-mono(a)forge.provo.novell.com Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- when trying to delete mono-devel Failed dependencies: mono(netstandard) = 2.0.0.0 is needed by (installed) mono-core-6.12.0-1.3.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1208510] podman/quadlet generating services with wrong podman binary path
by bugzilla_noreply＠suse.com 21 Feb '23

21 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208510 http://bugzilla.opensuse.org/show_bug.cgi?id=1208510#c1 Blake Burkhart <bburky(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |RESOLVED Resolution|--- |FIXED --- Comment #1 from Blake Burkhart <bburky(a)gmail.com> --- Thanks for the quick fix. I upgraded to podman-4.4.1-3.2.aarch64 which contains the sr#1066931 fix. The generated systemd unit now correctly uses /usr/bin/podman instead of /usr/local/bin/podman. -- You are receiving this mail because: You are on the CC list for the bug.

1 0