April 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1208394] AUDIT-0: ruby3.2-rubygem-agama: follow-up audit of D-Bus setup (separate D-Bus design)
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1208394 https://bugzilla.suse.com/show_bug.cgi?id=1208394#c9 Imobach Gonzalez Sosa <igonzalezsosa(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|AUDIT-0: |AUDIT-0: |ruby3.1-rubygem-d-installer |ruby3.2-rubygem-agama: |: follow-up audit of D-Bus |follow-up audit of D-Bus |setup (separate D-Bus |setup (separate D-Bus |design) |design) --- Comment #9 from Imobach Gonzalez Sosa <igonzalezsosa(a)suse.com> --- BTW, the "new" package is https://build.opensuse.org/package/show/YaST:Head:Agama/rubygem-agama. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208394] AUDIT-0: ruby3.1-rubygem-d-installer: follow-up audit of D-Bus setup (separate D-Bus design)
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1208394 https://bugzilla.suse.com/show_bug.cgi?id=1208394#c8 --- Comment #8 from Imobach Gonzalez Sosa <igonzalezsosa(a)suse.com> --- (In reply to Matthias Gerstner from comment #7) Hi Matthias, First of all, D-Installer has been renamed to Agama[1]. But they are the same thing code-wise. > So from your description in comment 4 it sounds like the addition a D-Bus > instance is kind of private to the two containers for backend and the web > components. Is that true? Can the UNIX domain socket be accessed from the > host > system otherwise? Yes, it is a private D-Bus instance and we have limited access to just the root user: https://github.com/openSUSE/agama/blob/master/service/share/dbus.conf. > Of course the interface of d-installer can be accessed indirectly via the web > component, I suppose. Will this listen on localhost or also on remotely > accessible network interfaces by default? It uses cockpit infrastructure for that, so it is available remotely too (not only in localhost). But if you access it remotely, it asks for a user/password. The problem is that, at this point, the user/password is a known one. Thinking about that, I guess we should ask the user to explicitly enable the remote access (and offer a way to set the root password at boot time). > The separate D-Bus instance only shared by the two containers sounds like it > improves the isolation on D-Bus level so I have no problem with that. > Although the use of containers on initrd level sounds pretty complex, design > wise. Agama does not rely on containers at all. You can run Agama in two different ways: * Using our Live media[2]. In that case, it does not rely on containers, although it still uses a private D-Bus instance. * On top of Iguana[3], running a container for the service and another for the web interface. Actually, we introduced the private D-Bus instance for this scenario. > > What I meant by asking if you are blocked by us is whether you are hitting > any > whitelisting restrictions that we need to fix? But I don't think so. No, we are not blocked, everything is working fine. Thanks for having a look. I will keep you informed if we introduced any relevant change. Regards, Imo [1] https://github.com/openSUSE/agama/pull/509 [2] https://build.opensuse.org/package/show/YaST:Head:Agama/agama-live [3] https://github.com/openSUSE/iguana -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 903974] Libraries missing symbol information
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=903974 https://bugzilla.suse.com/show_bug.cgi?id=903974#c5 --- Comment #5 from Jan Engelhardt <jengelh(a)inai.de> --- rpm is trying to approach this now, given upstream won't be of any help. https://github.com/rpm-software-management/rpm/pull/2372 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210265] New: VUL-0: CVE-2023-1801: tcpdump: out-of-bounds write in the SMB printer
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1210265 Bug ID: 1210265 Summary: VUL-0: CVE-2023-1801: tcpdump: out-of-bounds write in the SMB printer Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: pmonrealgonzalez(a)suse.com Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de Found By: --- Blocker: --- It was discovered that tcpdump before 4.99.4 contained an out-of-bounds write in the SMB printer (smbutil.c). The code incorrectly assumed that the format printed representation of the tm_year variable would always fit into 4 characters, which was not enough. This could lead to stack buffer overflow in some cases. References: https://github.com/the-tcpdump-group/tcpdump/commit/5caf4211264afa7d98820c6… https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.99.4/CHANGES#L7 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1210269] New: wireless-regdb out of date
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1210269 Bug ID: 1210269 Summary: wireless-regdb out of date Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: opensuse(a)1.opensuse.bgcomp.co.uk QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- wireless-regdb is seriously out of date. It's nearing 4 years old and has not been marked for update in 15.5. It's one of those things, given the legality of wireless usage, that is must be kept up to date. Please arrange new release. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1210268] New: Pandoc compiled without lua support
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1210268 Bug ID: 1210268 Summary: Pandoc compiled without lua support Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: kevin.legouguec(a)gmail.com QA Contact: qa-bugs(a)suse.de CC: peter.simons(a)suse.com Found By: --- Blocker: --- CC: peter.simons(a)suse.com Flags: needinfo?(peter.simons(a)suse.com) Hello, I have just upgraded to openSUSE-release 20230408. pandoc-cli has automatically been installed as part of the upgrade process; however, it seems that it is now missing features, namely: ``` $ pandoc --version pandoc 3.0.1 Features: +server -lua Scripting engine: none User data directory: /home/peniblec/.local/share/pandoc Copyright (C) 2006-2023 John MacFarlane. Web: https://pandoc.org This is free software; see the source for copying conditions. There is no warranty, not even for merchantability or fitness for a particular purpose. $ pandoc -L foo.lua </dev/null This version of pandoc has been compiled without Lua support. ``` Is this deliberate? Is there an alternative package that provides Lua support? If not, FWIW, upstream's INSTALL.md seems to suggest passing "lua" to "cabal configure --flags=FLAGSPEC". CC'ing Peter Simons, based on pandoc-cli.changes. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1210258] Configuring network for No Link and IP Setup still enables IPv6
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1210258 https://bugzilla.suse.com/show_bug.cgi?id=1210258#c2 Knut Alejandro Anderssen Gonz�lez <kanderssen(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|yast2-maintainers(a)suse.de |wicked-maintainers(a)suse.de --- Comment #2 from Knut Alejandro Anderssen Gonz�lez <kanderssen(a)suse.com> --- BTW, will ask also wicked maintainers about the setup as BOOTPROTO='none' should be used mainly for bonding slaves according to the man page and BOOTPROTO="static" without any address in order to skip the IP setup. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210265] VUL-0: CVE-2023-1801: tcpdump: out-of-bounds write in the SMB printer
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1210265 https://bugzilla.suse.com/show_bug.cgi?id=1210265#c2 Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS CC| |pmonrealgonzalez(a)suse.com Version|Leap 15.4 |Leap 15.5 --- Comment #2 from Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> --- Note that the SMB printer is disabled by default in all codestreams: > [ 68s] checking whether to enable the possibly-buggy SMB printer... no Also, this seems to only affect the Factory version 4.99.3 as the out-of-bounds was introduced in: * (master) https://github.com/the-tcpdump-group/tcpdump/commit/7578e1c0 * (4.99.3) https://github.com/the-tcpdump-group/tcpdump/commit/03c037bb -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210029] Can't hibernate laptop Lenovo L14 Gen 3 AMD
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1210029 Ancor Gonzalez Sosa <ancor(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |carlos.e.r(a)opensuse.org Flags| |needinfo?(carlos.e.r@opensu | |se.org) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210029] Can't hibernate laptop Lenovo L14 Gen 3 AMD
by bugzilla_noreply＠suse.com 10 Apr '23

10 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1210029 https://bugzilla.suse.com/show_bug.cgi?id=1210029#c28 Ancor Gonzalez Sosa <ancor(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ancor(a)suse.com --- Comment #28 from Ancor Gonzalez Sosa <ancor(a)suse.com> --- (In reply to Carlos Robinson from comment #27) > > Turned out that Beta partition kernel load line had no "resume=" entry Please, attach installation logs to check why YaST decided to not propose a "resume=" parameter. https://en.opensuse.org/openSUSE:Report_a_YaST_bug -- You are receiving this mail because: You are on the CC list for the bug.

1 0