February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1205236] [Staging] icu 72.1 breaks nodejs18/nodejs19
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1205236 https://bugzilla.suse.com/show_bug.cgi?id=1205236#c11 --- Comment #11 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2023:0419-1: An update that solves 7 vulnerabilities, contains two features and has three fixes is now available. Category: security (moderate) Bug References: 1200303,1201325,1201326,1201327,1201328,1203831,1203832,1205042,1205119,1205236 CVE References: CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215,CVE-2022-35255,CVE-2022-35256,CVE-2022-43548 JIRA References: PED-2097,PED-3192 Sources used: openSUSE Leap 15.5 (src): nodejs18-18.13.0-150400.9.3.1 openSUSE Leap 15.4 (src): nodejs18-18.13.0-150400.9.3.1 SUSE Linux Enterprise Module for Web Scripting 15-SP4 (src): nodejs18-18.13.0-150400.9.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1205042] New: [TRACKERBUG] Set openssl 3.0.7 as the default openssl in TW
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1205042 Bug ID: 1205042 Summary: [TRACKERBUG] Set openssl 3.0.7 as the default openssl in TW Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: pmonrealgonzalez(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This tracker-bug will be used for the switch from OpenSSL 1.1.1x to version 3.0.7 in TW and collects information about the main changes in version 3.0.x and the list of packages that need to be adapted for the upgrade. Major changes in 3.0.0: * OpenSSL 3.0 is a major release and consequently any application that currently uses an older version of OpenSSL will at the very least need to be recompiled in order to work with the new version. * The OpenSSL versioning scheme has changed with the 3.0 release to format: MAJOR.MINOR.PATCH The patch level is indicated by the third number instead of a letter * Providers and FIPS support Providers collect together and make available algorithm implementations. * Use of the low level APIs have been deprecated. * Some cryptographic algorithms that were available via the EVP APIs are now considered legacy and their use is strongly discouraged. * Engines and "METHOD" APIs are deprecated and shall be transformed to providers. OpenSSL 3.0.0 design: * https://www.openssl.org/docs/OpenSSL300Design.html Migration guide: * https://www.openssl.org/docs/man3.0/man7/migration_guide.html OpenSSL wiki: * https://wiki.openssl.org/index.php/OpenSSL_3.0 -- You are receiving this mail because: You are on the CC list for the bug.

1 40

[Bug 1208316] New: Java:packages/xmlgraphics-batik: CVE-2022-41704 CVE-2022-42890 requires update to 1.16
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208316 Bug ID: 1208316 Summary: Java:packages/xmlgraphics-batik: CVE-2022-41704 CVE-2022-42890 requires update to 1.16 Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: fstrba(a)suse.com Reporter: rpm(a)fthiessen.de QA Contact: screening-team-bugs(a)suse.de Found By: --- Blocker: --- Current batik version in openSUSE is vulnerable to those two security issues: https://nvd.nist.gov/vuln/detail/CVE-2022-41704 https://nvd.nist.gov/vuln/detail/CVE-2022-42890 Both are fixed in current release 1.16, so updating the package to the new release is strongly encouraged. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208258] [Build 399.1] yast2_ntpclient - in/cp: cannot stat '/mnt/boot/vmlinuz': No such file or directory
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208258 https://bugzilla.suse.com/show_bug.cgi?id=1208258#c2 --- Comment #2 from Stefan Hundhammer <shundhammer(a)suse.com> --- https://github.com/yast/yast-ntp-client/blob/master/src/lib/cfa/chrony_conf… class ChronyConf < ::CFA::BaseModel PATH = "/etc/chrony.d/pool.conf".freeze ... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207654] New: AUDIT-FIND: kismet: systemd service unnecessarily runs as root
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207654 Bug ID: 1207654 Summary: AUDIT-FIND: kismet: systemd service unnecessarily runs as root Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de CC: mardnh(a)gmx.de, meissner(a)suse.com, wolfgang.frisch(a)suse.com Depends on: 1200954 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1200954 +++ kismet's systemd service unnecessarily runs as root. Upstream actually warns about it [1], since only the individual capture binaries require special privileges, but not the main kismet daemon. However we shouldn't adopt their recommendations verbatim, that is to install the capture binaries as setuid-root. Instead of setuid-root, we can use more fine-grained Linux capabilities [2]. Note there's already a submit request underway [3] with a number of systemd hardenings. We can keep those, and additionally drop privileges. [1] https://github.com/kismetwireless/kismet/blob/master/packaging/systemd/READ… [2] capabilities(7) setcap(8) [3] https://build.opensuse.org/request/show/1046457 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1208258] [Build 399.1] yast2_ntpclient - in/cp: cannot stat '/mnt/boot/vmlinuz': No such file or directory
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208258 https://bugzilla.suse.com/show_bug.cgi?id=1208258#c1 --- Comment #1 from Stefan Hundhammer <shundhammer(a)suse.com> --- This test greps /etc/chrony.conf to check for the value that was just configured. AFAIK there is now /etc/chrony.d/pool.conf. https://github.com/yast/yast-ntp-client/blob/master/package/yast2-ntp-clien… ------------------------------------------------------------------- Mon Jan 23 18:50:11 UTC 2023 - Michal Filka <mfilka(a)suse.com> - bsc#1188980 - ntp dialog allows to manually set ntp source - ntp source can be selected as pool or server - ntp sources are written into /etc/chrony.d/pools.conf - 4.5.3 ------------------------------------------------------------------- So IMHO the test needs to be adapted accordingly. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207940] New: [Build 20230205] openssl-3: tpm unable to enable public key encoding
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207940 Bug ID: 1207940 Summary: [Build 20230205] openssl-3: tpm unable to enable public key encoding Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3101026/modules/tpm2 _engine_ecdsa_operation/steps/15 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: openQA Blocker: Yes ## Observation With the switch to openssl-3, the tpm tests started failing in openQA: # Test died: command 'openssl ec -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub' failed at /usr/lib/os-autoinst/autotest.pm line 387. # Result: Engine "tpm2tss" set. read EC key unable to enable public key encoding 40576458237F0000:error:030000A3:digital envelope routines:EVP_PKEY_set_params:invalid key:crypto/evp/p_lib.c:2353: XHqhV-1- ## openQA references openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-security_tpm2_swtpm@64bit fails in [tpm2_engine_ecdsa_operation](https://openqa.opensuse.org/tests/3101026/modu… ## Test suite description The base test suite is used for job templates defined in YAML documents. It has no settings of its own. ## Reproducible Fails since (at least) Build [20230205](https://openqa.opensuse.org/tests/3101026) (current job) ## Expected result Last good: [20230201](https://openqa.opensuse.org/tests/3089306) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1207948] Lenovo T14s Gen3 AMD resume from hibernation ends in kernel panic
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207948 https://bugzilla.suse.com/show_bug.cgi?id=1207948#c26 --- Comment #26 from Takashi Iwai <tiwai(a)suse.com> --- A new test kernel is being built in OBS home:tiwai:bsc1207948 repo. Once when the Kernel:HEAD as of today still fails (with or without the reduced timeout_ms hack), give it a try later. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207948] Lenovo T14s Gen3 AMD resume from hibernation ends in kernel panic
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207948 https://bugzilla.suse.com/show_bug.cgi?id=1207948#c25 --- Comment #25 from Takashi Iwai <tiwai(a)suse.com> --- (In reply to Martin Jambor from comment #24) > (In reply to Takashi Iwai from comment #18) > > Also, just to be sure: there are a few changes in linux-next for mhi bus > > code (for 6.3). Can anyone test quickly linux-next kernel to see whether > > the problem persists (e.g. with kernel-vanilla in OBS Kernel:linux-next > > repo)? > > I'm sorry but I probably cannot test this - the kernel from > kernel-vanilla-6.2~rc7.next.20230213-1.1.g059273c.x86_64 does not seem to be > able to unlock my encrypted partition? Hm, I don't know what's missing. There should be really little difference between vanilla and default kernels. I'll try to backport the patches from linux-next on top of the latest 6.2-rc8. Meanwhile, could you confirm that the same behavior appears with the 6.2-rc8 kernel from OBS Kernel:HEAD? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208198] Tumbleweed from 20230213 (glibc 2.37) has stack protector triggering in libdl of libGLX_nvidia.so.0
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208198 http://bugzilla.opensuse.org/show_bug.cgi?id=1208198#c36 --- Comment #36 from patrick shanahan <paka(a)opensuse.org> --- (In reply to Stefan Dirsch from comment #35) > (In reply to Stefan Dirsch from comment #34) > > @Patriick Maybe you did something wrong when applying the fix. Check with > > the reproduce of comment#1. Maybe my fixed packages will fix the issue for > > you. These should be available late this week hopefully. Otherwise I'm > > afraid you need to update your gfxcard or you can't update TW any longer or > > need to switch to Leap with this gfxcard. I'm sorry! :-( > > Just noticed that the nvidia tumbleweed repository already have been updated > with the fixed G04 packages. :-) followed "comment#1", produced no error. will upddate nvidia tw packages later today with glibc 2.37-1 and report. tks for your help and efforts. -- You are receiving this mail because: You are on the CC list for the bug.

1 0