March 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1203190] New: VUL-1: CVE-2022-35931: nextcloud: Password Policy app could generate passwords that would be block
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1203190 Bug ID: 1203190 Summary: VUL-1: CVE-2022-35931: nextcloud: Password Policy app could generate passwords that would be block Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/341558/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2022-35931 Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-35931 https://www.cve.org/CVERecord?id=CVE-2022-35931 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c… https://github.com/nextcloud/password_policy/pull/363 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1207976] New: VUL-0: CVE-2023-23942: nextcloud-desktop: missing sanitisation on qml labels leading to javascript injection
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207976 Bug ID: 1207976 Summary: VUL-0: CVE-2023-23942: nextcloud-desktop: missing sanitisation on qml labels leading to javascript injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/356329/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2023-23942 The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23942 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… https://www.cve.org/CVERecord?id=CVE-2023-23942 https://github.com/nextcloud/desktop/pull/5233 https://hackerone.com/reports/1788598 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1201070] New: Tumbleweed 20220629: can't install nextcloud-desktop
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1201070 Bug ID: 1201070 Summary: Tumbleweed 20220629: can't install nextcloud-desktop Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: Mathias.Homann(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I'm trying to install the nextcloud desktop client on TW 20220629 but it fails with dependency issues: twvm:~ # zypper in nextcloud-desktop Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides 'libQt5Gui.so.5(Qt_5.15.2_PRIVATE_API)(64bit)' needed by the to be installed nextcloud-desktop-3.5.1-1.1.x86_64 Solution 1: do not install nextcloud-desktop-3.5.1-1.1.x86_64 Solution 2: break nextcloud-desktop-3.5.1-1.1.x86_64 by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c/d/?] (c): c twvm:~ # cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20220629" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20220629" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:tumbleweed:20220629" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo-Tumbleweed" on TW 20220628 it installs ok. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1207978] New: VUL-0: CVE-2023-23944: nextcloud: user's passwordsstored in cleartext in the database during the duration of OAuth2 setup procedure
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207978 Bug ID: 1207978 Summary: VUL-0: CVE-2023-23944: nextcloud: user's passwordsstored in cleartext in the database during the duration of OAuth2 setup procedure Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/356232/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2023-23944 Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23944 https://github.com/nextcloud/mail/pull/7797 https://www.cve.org/CVERecord?id=CVE-2023-23944 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g… https://hackerone.com/reports/1806275 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1207977] New: VUL-0: CVE-2023-23943: nextcloud: IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1207977 Bug ID: 1207977 Summary: VUL-0: CVE-2023-23943: nextcloud: IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/356328/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2023-23943 Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-23943 https://www.cve.org/CVERecord?id=CVE-2023-23943 https://github.com/nextcloud/mail/pull/7796 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8… https://hackerone.com/reports/1741525 https://hackerone.com/reports/1736390 https://hackerone.com/reports/1746582 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1209524] New: Playstation DualSense driver might be resetting my NVMe SSD controller.
by bugzilla_noreply＠suse.com 01 Apr '23

01 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1209524 Bug ID: 1209524 Summary: Playstation DualSense driver might be resetting my NVMe SSD controller. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jorge.blasio(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0 Build Identifier: Yesterday I was playing FFXIV and suddenly upon log in I tried a controller button combination and wham, client crashed and my Steam Library disappeared. Something similar has happened before so there it was, journalctl informed me my NVMe drive which holds my games was made read-only. However this time it wasn't a faulty drive, one message before the controller goes down, there's a DualSense error. I'm not a developer just a linux convert from a few years so it might not be this but it has happened 3 times already and the playstation driver line keeps appearing just before the controller reset. Reproducible: Always Steps to Reproduce: 1.Start Steam and connect a DualSense controller 2.Play 3. Actual Results: I haven't been able to reproduce it to the letter, I cannot make a controller button press trigger the SSD reset, but I've used a completely different type of controller (an arcade stick from another company in xinput mode) and the system is solid, played for hours. Expected Results: Using the DualSense controller without my system losing SSD access. lavadrop5@klaasje:~> sudo journalctl -k -r -b -2 mar 19 12:49:12 klaasje kernel: audit: type=1305 audit(1679251752.338:485): op=set audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=unconfined res=1 mar 19 12:49:12 klaasje kernel: audit: type=1305 audit(1679251752.338:485): op=set audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=unconfined res=1 mar 19 12:49:12 klaasje kernel: audit: type=1305 audit(1679251752.310:484): op=set audit_pid=0 old=1241 auid=4294967295 ses=4294967295 subj=unconfined res=1 mar 19 12:49:12 klaasje kernel: kauditd_printk_skb: 55 callbacks suppressed mar 19 12:49:11 klaasje kernel: wlp6s0: deauthenticating from 0c:73:29:a1:49:da by local choice (Reason: 3=DEAUTH_LEAVING) mar 19 12:49:10 klaasje kernel: nfsd: last server has exited, flushing export cache mar 19 12:49:10 klaasje kernel: rfkill: input handler enabled mar 19 12:29:49 klaasje kernel: nvme1n1: detected capacity change from 3907029168 to 0 mar 19 12:29:49 klaasje kernel: nvme nvme1: Disabling device after reset failure: -19 mar 19 12:29:49 klaasje kernel: nvme 0000:04:00.0: enabling device (0000 -> 0002) mar 19 12:29:49 klaasje kernel: nvme nvme1: Try "nvme_core.default_ps_max_latency_us=0 pcie_aspm=off" and report a bug mar 19 12:29:49 klaasje kernel: nvme nvme1: Does your device have a faulty power saving mode enabled? mar 19 12:29:49 klaasje kernel: nvme nvme1: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS=0x10 mar 19 12:20:15 klaasje kernel: BTRFS: error (device nvme0n1p1: state EA) in cleanup_transaction:1984: errno=-5 IO failure mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1: state EA): Transaction aborted (error -5) mar 19 12:20:15 klaasje kernel: BTRFS warning (device nvme0n1p1: state E): Skipping commit of aborted transaction. mar 19 12:20:15 klaasje kernel: BTRFS info (device nvme0n1p1: state E): forced readonly mar 19 12:20:15 klaasje kernel: BTRFS: error (device nvme0n1p1) in btrfs_commit_transaction:2474: errno=-5 IO failure (Error while writing out transaction) mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 5, rd 5, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 5, rd 4, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 4, rd 4, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 4, rd 3, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 3, rd 3, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 3, rd 2, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 2, rd 2, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 2, rd 1, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 1, rd 1, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: BTRFS error (device nvme0n1p1): bdev /dev/nvme0n1p1 errs: wr 1, rd 0, flush 0, corrupt 0, gen 0 mar 19 12:20:15 klaasje kernel: nvme0n1: detected capacity change from 1953525168 to 0 mar 19 12:20:15 klaasje kernel: nvme nvme0: Disabling device after reset failure: -19 mar 19 12:20:15 klaasje kernel: nvme 0000:01:00.0: enabling device (0000 -> 0002) mar 19 12:20:15 klaasje kernel: nvme nvme0: Try "nvme_core.default_ps_max_latency_us=0 pcie_aspm=off" and report a bug mar 19 12:20:15 klaasje kernel: nvme nvme0: Does your device have a faulty power saving mode enabled? mar 19 12:20:15 klaasje kernel: nvme nvme0: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS=0x10 mar 19 11:57:40 klaasje kernel: amdgpu 0000:0b:00.0: amdgpu: Disabling VM faults because of PRT request! mar 19 11:57:23 klaasje kernel: input: Microsoft X-Box 360 pad 0 as /devices/virtual/input/input31 mar 19 11:57:09 klaasje kernel: perf: interrupt took too long (2583 > 2500), lowering kernel.perf_event_max_sample_rate to 77250 mar 19 11:46:37 klaasje kernel: playstation: probe of 0003:054C:0CE6.0008 failed with error -17 mar 19 11:46:37 klaasje kernel: playstation 0003:054C:0CE6.0008: Failed to create dualsense. mar 19 11:46:37 klaasje kernel: playstation 0003:054C:0CE6.0008: Duplicate device found for MAC address 48:18:8d:ed:26:c7. mar 19 11:46:37 klaasje kernel: playstation 0003:054C:0CE6.0008: hidraw7: USB HID v1.11 Gamepad [Sony Interactive Entertainment Wireless Controller] on usb-0000:0d:00.3-1.1/input3 mar 19 11:46:36 klaasje kernel: usb 2-1.1: Manufacturer: Sony Interactive Entertainment mar 19 11:46:36 klaasje kernel: usb 2-1.1: Product: Wireless Controller mar 19 11:46:36 klaasje kernel: usb 2-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 mar 19 11:46:36 klaasje kernel: usb 2-1.1: New USB device found, idVendor=054c, idProduct=0ce6, bcdDevice= 1.00 mar 19 11:46:36 klaasje kernel: usb 2-1.1: new high-speed USB device number 5 using xhci_hcd mar 19 11:42:14 klaasje kernel: input: Microsoft X-Box 360 pad 0 as /devices/virtual/input/input30 mar 19 11:39:12 klaasje kernel: BTRFS info (device dm-2): qgroup scan completed (inconsistency flag cleared) mar 19 11:32:08 klaasje kernel: input: Microsoft X-Box 360 pad 0 as /devices/virtual/input/input29 mar 19 11:29:28 klaasje kernel: playstation 0005:054C:0CE6.0007: Registered DualSense controller hw_version=0x00000413 fw_version=0x01040027 mar 19 11:29:28 klaasje kernel: input: Wireless Controller Touchpad as /devices/pci0000:00/0000:00:01.2/0000:02:00.0/0000:03:08.0/0000:08:00.3/usb3/3-5/3-5:1.0/bluetooth/hci0/hci0:256/0005:054C:0CE6.0007/input/input28 mar 19 11:29:28 klaasje kernel: input: Wireless Controller Motion Sensors as /devices/pci0000:00/0000:00:01.2/0000:02:00.0/0000:03:08.0/0000:08:00.3/usb3/3-5/3-5:1.0/bluetooth/hci0/hci0:256/0005:054C:0CE6.0007/input/input27 mar 19 11:29:28 klaasje kernel: input: Wireless Controller as /devices/pci0000:00/0000:00:01.2/0000:02:00.0/0000:03:08.0/0000:08:00.3/usb3/3-5/3-5:1.0/bluetooth/hci0/hci0:256/0005:054C:0CE6.0007/input/input26 mar 19 11:29:28 klaasje kernel: playstation 0005:054C:0CE6.0007: hidraw6: BLUETOOTH HID v1.00 Gamepad [Wireless Controller] on b0:a4:60:ea:ea:b0 mar 19 11:29:28 klaasje kernel: playstation 0005:054C:0CE6.0007: unknown main item tag 0x0 mar 19 11:29:28 klaasje kernel: hid-generic 0005:054C:0CE6.0007: input,hidraw6: BLUETOOTH HID v1.00 Gamepad [Wireless Controller] on b0:a4:60:ea:ea:b0 mar 19 11:29:28 klaasje kernel: input: Wireless Controller as /devices/pci0000:00/0000:00:01.2/0000:02:00.0/0000:03:08.0/0000:08:00.3/usb3/3-5/3-5:1.0/bluetooth/hci0/hci0:256/0005:054C:0CE6.0007/input/input25 mar 19 11:29:28 klaasje kernel: hid-generic 0005:054C:0CE6.0007: unknown main item tag 0x0 mar 19 11:29:28 klaasje kernel: Bluetooth: HIDP socket layer initialized mar 19 11:29:28 klaasje kernel: Bluetooth: HIDP (Human Interface Emulation) ver 1.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1200511] New: evince keeps crashing
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1200511 Bug ID: 1200511 Summary: evince keeps crashing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: wardlawhunter(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am getting consistent crashes from evince when trying to view a pdf. If I scroll or page down through this pdf about 10 pages it will reliably crash. The terminal produces the following error output after crashing: evince: cairo-error.c:68: _cairo_error: Assertion `_cairo_status_is_error (status)' failed. Aborted (core dumped) -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1189907] New: gnome-software: packages from the main distro repository should not be marked as potentially dangerous
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1189907 Bug ID: 1189907 Summary: gnome-software: packages from the main distro repository should not be marked as potentially dangerous Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- it should work more like software.o.o categorizes packages. i think the main culprit might be that it doesnt have any permissions information like it has for flatpak based apps. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1204865] No HEIC image preview in nautilus / gnome file manager
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1204865 http://bugzilla.opensuse.org/show_bug.cgi?id=1204865#c10 Bj�rn Lie <bjorn.lie(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |bjorn.lie(a)gmail.com Resolution|--- |FIXED --- Comment #10 from Bj�rn Lie <bjorn.lie(a)gmail.com> --- Closing as fixed - changes in place for months -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204564] New: Nautilus is laggy and slow on GNOME 43
by bugzilla_noreply＠suse.com 31 Mar '23

31 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1204564 Bug ID: 1204564 Summary: Nautilus is laggy and slow on GNOME 43 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: sfalken(a)cloverleaf-linux.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Nautilus is slow to generate thumbnails and list directories in current GNOME 43. Through investigation, it appears that at-spi2-core is not being installed along with Nautilus. Installing it manually results in Nautilus generating thumbnails and directory previews much faster, as expected. I suggest at-spi2-core should be added perhaps as a Recommends: for Nautilus? -- You are receiving this mail because: You are on the CC list for the bug.

1 6