March 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1208766] Kernel 6.2.1 does not suspend/hibernate anymore for AMD Ryzen 7 Pro
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1208766 https://bugzilla.suse.com/show_bug.cgi?id=1208766#c6 --- Comment #6 from Frank Kr�ger <fkrueger(a)mailbox.org> --- FYI: For kernel-vanilla-6.2.1-1.1.g69e0e95.x86_64 hibernation/suspend works as expected, with secure boot enabled. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208804] NetworkManager DNS fowarders update with dnsmasq doesn't work
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208804 Frank Kr�ger <fkrueger(a)mailbox.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fkrueger(a)mailbox.org -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201089] [META] GCC 13 package failures
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1201089 Bug 1201089 depends on bug 1207468, which changed state. Bug 1207468 Summary: GCC 13: virtualbox package fails https://bugzilla.suse.com/show_bug.cgi?id=1207468 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208766] Kernel 6.2.1 does not suspend/hibernate anymore for AMD Ryzen 7 Pro
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1208766 https://bugzilla.suse.com/show_bug.cgi?id=1208766#c5 --- Comment #5 from Frank Kr�ger <fkrueger(a)mailbox.org> --- Given secure boot enabled, for kernel <= 6.2.0 we have > cat /sys/kernel/security/lockdown [none] integrity confidentiality while for kernel 6.2.1 > cat /sys/kernel/security/lockdown none [integrity] confidentiality Bug or feature? As for the latter, I don't see any hint in the changelog of 6.2.1: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.1 Any idea? Thx. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208766] Kernel 6.2.1 does not suspend/hibernate anymore for AMD Ryzen 7 Pro
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1208766 https://bugzilla.suse.com/show_bug.cgi?id=1208766#c4 --- Comment #4 from Frank Kr�ger <fkrueger(a)mailbox.org> --- (In reply to Joey Lee from comment #3) > After the Tumbleweed kernel be locked down, the only way for using > hibernation is disabled EFI secure boot. User can use UEFI firmware UI to > disable secure boot, or using mokutil to disable validation from shim layer: > > mokutil --disable-validation > > > On the other hand, upstream is working on a solution with TPM2: > > [PATCH v5 00/11] Encrypted Hibernation > https://lkml.org/lkml/2022/11/11/1229 Of course, disabling secure boot solves the hibernation/suspend issue with kernel 6.2.1. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208812] New: Workrave: too many cinnamon dependencies in KDE environment
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208812 Bug ID: 1208812 Summary: Workrave: too many cinnamon dependencies in KDE environment Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: 64bit URL: https://workrave.org OS: openSUSE Tumbleweed Status: NEW Severity: Minor Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: wrmbrr(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: Other Blocker: --- I use KDE and when trying to install Workrave many cinnamon dependencies appear, totaling 148.3 MiB. I have never seen this in other distros. In October 2022 I reported it on github, but they recommended that I report it to the package maintainer. I looked for where to do this, but I couldn't find it. And after installed it has a bug that does not appear the sound type of notifications. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1208745] VUL-0: CVE-2023-27371: libmicrohttpd: parser bug that could be used to crash servers using the MHD_PostProcessor
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1208745 https://bugzilla.suse.com/show_bug.cgi?id=1208745#c7 Valentin Lefebvre <valentin.lefebvre(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|coldpool(a)suse.de |security-team(a)suse.de --- Comment #7 from Valentin Lefebvre <valentin.lefebvre(a)suse.com> --- Request submitted to: - SUSE:SLE-12:Update/libmicrohttpd - SUSE:SLE-15:Update/libmicrohttpd And update already submitted: - openSUSE:Factory/libmicrohttpds I believe all fixed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208745] New: VUL-1: libmicrohttpd: parser bug that could be used to crash servers using the MHD_PostProcessor
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208745 Bug ID: 1208745 Summary: VUL-1: libmicrohttpd: parser bug that could be used to crash servers using the MHD_PostProcessor Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- GNU libmicrohttpd 0.9.76 fixes a security problem in the MHD_PostProcessor where malformed inputs can be used to crash the server (for denial-of-service). Only applies for applications that use the (optional) MHD_PostProcessing logic. References: https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html https://git.gnunet.org/libmicrohttpd.git/commit/?id=6d6846e20bfdf4b3eb1b592… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1207450] New: VUL-0: CVE-2022-44566: rubygem-activerecord-*: Possible Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1207450 Bug ID: 1207450 Summary: VUL-0: CVE-2022-44566: rubygem-activerecord-*: Possible Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mschnitzer(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: --- Blocker: --- Created attachment 864343 --> https://bugzilla.suse.com/attachment.cgi?id=864343&action=edit 7.0 patch Possible Denial of Service Vulnerability in ActiveRecord��s PostgreSQL adapter There is a potential denial of service vulnerability present in ActiveRecord��s PostgreSQL adapter. This has been assigned the CVE identifier CVE-2022-44566. Versions Affected: All. Not affected: None. Fixed Versions: 7.0.4.1, 6.1.7.1 Impact In ActiveRecord <7.0.4.1 and <6.1.7.1, when a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service. Releases The fixed releases are available at the normal locations. Workarounds Ensure that user supplied input which is provided to ActiveRecord clauses do not contain integers wider than a signed 64bit representation or floats. Patches To aid users who aren��t able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset. 6-1-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 6.1 series 7-0-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 7.0 series Credits Thank you Jeremy Evans for reporting this! -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1196335] [Build C.520.1] kdump failed to start: device or resource busy
by bugzilla_noreply＠suse.com 01 Mar '23

01 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1196335 https://bugzilla.suse.com/show_bug.cgi?id=1196335#c13 --- Comment #13 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2023:0588-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1186745, 1196335 Sources used: openSUSE Leap Micro 5.3 (src): kdump-1.0.2+git20.g64239cc-150400.3.11.1 openSUSE Leap 15.4 (src): kdump-1.0.2+git20.g64239cc-150400.3.11.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): kdump-1.0.2+git20.g64239cc-150400.3.11.1 SUSE Linux Enterprise Micro 5.3 (src): kdump-1.0.2+git20.g64239cc-150400.3.11.1 Basesystem Module 15-SP4 (src): kdump-1.0.2+git20.g64239cc-150400.3.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0