February 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1195018] New: VUL-0: CVE-2022-23808: phpMyAdmin: Multiple XSS and HTML injection attacks in setup script (PMASA-2022-2)
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1195018 Bug ID: 1195018 Summary: VUL-0: CVE-2022-23808: phpMyAdmin: Multiple XSS and HTML injection attacks in setup script (PMASA-2022-2) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de CC: chris(a)computersalat.de, lang(a)b1-systems.de Found By: --- Blocker: --- It was discovered that phpMyAdmin versions prior to 5.1.2 are vulnerable to multiple XSS and HTML injection attacks in setup script. A series of weaknesses has been discovered that could allow an attacker to inject malicious code in to aspects of the setup script, which can allow XSS or HTML injection. Considered moderate upstream. If a configuration file config.inc.php exists these issues are mitigated. References: https://www.phpmyadmin.net/security/PMASA-2022-2/ https://github.com/phpmyadmin/phpmyadmin/commit/5118acce1dfcdb09cbc0f73927b… https://github.com/phpmyadmin/phpmyadmin/commit/44eb12f15a562718bbe54c9a16a… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1195017] New: VUL-1: CVE-2022-23807: phpMyAdmin: Two factor authentication bypass (PMASA-2022-1)
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1195017 Bug ID: 1195017 Summary: VUL-1: CVE-2022-23807: phpMyAdmin: Two factor authentication bypass (PMASA-2022-1) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de CC: chris(a)computersalat.de, lang(a)b1-systems.de Found By: --- Blocker: --- It was discovered that version of phpMyAdmin prior to 4.9.8 and 5.1.2 are subject to a bypass of two-factor authentication. There is a sequence of actions a valid user can take that will allow them to bypass two factor authentication for that account. A user must first connect to phpMyAdmin (presumably using their two factor authentication method) in order to prepare their account for the bypass. Note that a user is still able to disable two factor authentication through conventional means; this only addresses an unintentional security weakness in how phpMyAdmin processes a user's two factor status. References: https://www.phpmyadmin.net/security/PMASA-2022-1/ https://github.com/phpmyadmin/phpmyadmin/commit/ca54f1db050859eb8555875c6aa… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1205763] GnuTLS 3.8.0 removes guile bindings
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1205763 https://bugzilla.suse.com/show_bug.cgi?id=1205763#c8 Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|GnuTLS 3.7.9 removes guile |GnuTLS 3.8.0 removes guile |bindings |bindings --- Comment #8 from Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> --- Upstream has released version 3.7.9 but still keeps guile bindings. These have been removed in 3.8.0 also released in parallel, see: * https://lists.gnupg.org/pipermail/gnutls-help/2023-February/004816.html I'm preparing the update to version 3.8.0 and removing all the guile bindings. Once ready, we can submit the new gnutls-guile package and the gnutls 3.8.0 in parallel. I'm renaming the bug also to address the right version. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208303] New: AUDIT-FIND: kismet: predictable lock file in /tmp created by kismet_cap_linux_wifi
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208303 Bug ID: 1208303 Summary: AUDIT-FIND: kismet: predictable lock file in /tmp created by kismet_cap_linux_wifi Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- kismet_cap_linux_wifi creates a predictable file in /tmp [1]: ``` int acquire_interface_lock(local_wifi_t *local_wifi) { local_wifi->lock_fd = open("/tmp/.kismet_cap_linux_wifi_interface_lock", O_CREAT | O_WRONLY, S_IWUSR | S_IWGRP); // Further down, a system-wide exclusive lock on this file is obtained: flock(local_wifi->lock_fd, LOCK_EX | LOCK_NB) ``` When kismet is installed according to the official documentation (as of now) [2], this program will have either setuid-root set or it will be executed as root by the main kismet daemon. This allows an unprivileged user to a) create arbitrary files on the system if /proc/sys/fs/protected_symlinks=0 b) obtain locks for arbitrary files on the system, if /proc/sys/fs/protected_symlinks=0 c) deny kismet's service if the capture binaries are installed without setuid-root but with file capabilities. [1] https://github.com/kismetwireless/kismet/blob/cca9ed610d640d89f2c8c63f678b0… [2] https://www.kismetwireless.net/packages/#suid-root--privileged-capture -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1167519] New: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim
by bugzilla_noreply＠novell.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1167519 Bug ID: 1167519 Summary: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/255622/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: luke(a)ljones.dev Reporter: wolfgang.frisch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-10870 Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10870 https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/1028 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10870 -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1208287] Leap 15.4 debug non-oss repo empty
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208287 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208287] Leap 15.4 debug non-oss repo empty
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1208287 https://bugzilla.suse.com/show_bug.cgi?id=1208287#c1 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #1 from Marcus Meissner <meissner(a)suse.com> --- RepoType: rpm-md:deltainfo:rsyncable splitdebug:_debug added to projectconfig. Likely will only be visible when the next update is released -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207732] gnome-boxes crashes when trying "Express install" Leap 15.4
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207732 https://bugzilla.suse.com/show_bug.cgi?id=1207732#c3 --- Comment #3 from Alynx Zhou <alynx.zhou(a)suse.com> --- (In reply to Alynx Zhou from comment #2) > > #8 0x000055c0e8aa3ff0 in fread (__stream=0x55c0e91a9b30, __n=4781, __size=4781, __ptr=0x55c0e9ab3c50) at /usr/include/bits/stdio2.h:240 > > This looks really wired to me (I mean n=4781 and size=4781), it should not. > But gnome boxes is written in vala, which is translated into C so those > should be automatically calculated... It looks like there are mismatch on Valadoc and translation between vala and C fread, I'll try to reproduce it with a minimal code piece. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208091] VUL-0: CVE-2023-25165: trivy: helm: getHostByName Function Information Disclosure
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208091 http://bugzilla.opensuse.org/show_bug.cgi?id=1208091#c3 --- Comment #3 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1208091) was mentioned in https://build.opensuse.org/request/show/1065886 Factory / trivy https://build.opensuse.org/request/show/1065887 Backports:SLE-15-SP4 / trivy https://build.opensuse.org/request/show/1065888 Backports:SLE-15-SP5 / trivy -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207732] gnome-boxes crashes when trying "Express install" Leap 15.4
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1207732 https://bugzilla.suse.com/show_bug.cgi?id=1207732#c2 Alynx Zhou <alynx.zhou(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alynx.zhou(a)suse.com --- Comment #2 from Alynx Zhou <alynx.zhou(a)suse.com> --- > #8 0x000055c0e8aa3ff0 in fread (__stream=0x55c0e91a9b30, __n=4781, __size=4781, __ptr=0x55c0e9ab3c50) at /usr/include/bits/stdio2.h:240 This looks really wired to me (I mean n=4781 and size=4781), it should not. But gnome boxes is written in vala, which is translated into C so those should be automatically calculated... -- You are receiving this mail because: You are on the CC list for the bug.

1 0