April 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1210042] New: VUL-0: CVE-2023-24824: polynomial time complexity during rendering leads to DoS
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1210042 Bug ID: 1210042 Summary: VUL-0: CVE-2023-24824: polynomial time complexity during rendering leads to DoS Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: peter.simons(a)suse.com Found By: --- Blocker: --- CVE-2023-24824 cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24824 https://www.cve.org/CVERecord?id=CVE-2023-24824 http://www.cvedetails.com/cve/CVE-2023-24824/ https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c415… https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1210041] New: VUL-0: CVE-2023-26485: ghc-cmark-gfm: polynomial time complexity during rendering leads to DoS
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1210041 Bug ID: 1210041 Summary: VUL-0: CVE-2023-26485: ghc-cmark-gfm: polynomial time complexity during rendering leads to DoS Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: peter.simons(a)suse.com Found By: --- Blocker: --- CVE-2023-26485 cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. ### Impact A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. ### Proof of concept ``` $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext ``` Increasing the number 10000 in the above commands causes the running time to increase quadratically. ### Patches This vulnerability have been patched in 0.29.0.gfm.10. ### Note on cmark and cmark-gfm XXX: TBD [cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. ### Credit We would like to thank @gravypod for reporting this vulnerability. ### References https://en.wikipedia.org/wiki/Time_complexity ### For more information If you have any questions or comments about this advisory: * Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm) References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26485 https://www.cve.org/CVERecord?id=CVE-2023-26485 http://www.cvedetails.com/cve/CVE-2023-26485/ https://github.com/github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6… https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1209923] YaST Partitioner produces invalid GPT (on USB drive) after removing two partitions
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209923 https://bugzilla.suse.com/show_bug.cgi?id=1209923#c6 --- Comment #6 from Stefan Hundhammer <shundhammer(a)suse.com> --- Well, the YaST partitioner starts with a stern warning that you should only use it if you know very well what you are doing. The reasoning for that is not that we consider our users to be stupid, but that we know that this is a tool that is perfectly capable of letting you shoot yourself in the foot. It's powerful and flexible; it operates on a very low system level. And that gives plenty of potential to do damage as well as to fix things in very pathological situations. That goes both ways. So, maybe you intentionally got your USB stick (or more general: disk) into a state that is not 100% consistent; like in your dd'ing an ISO scenario. Maybe in that situation, you still need to so some tweaking to make the installation work for you; your BIOS may be a bit quirky and need some more customizing on that stick to make it boot. We don't know. And we don't want to impose more restrictions upon you than absolutely necessary to use the tool. The moment we introduce even more checks and restrictions, somebody will complain bitterly that we made his special use case impossible. If anything is missing here, it might be that piece of documentation that tells users how to restore their USB stick for general use after they no longer need the installation ISO on it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1207554] openSUSE Tumbleweed 20230123 doesn't boot after installation on Intel RST VMD volume
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1207554 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |master.yodo(a)gmail.com Flags| |needinfo?(master.yodo@gmail | |.com) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209725] autoinst.xml gen by "yast2 clone_system" mess thin pool LVM partitions?
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209725 Ancor Gonzalez Sosa <ancor(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED URL| |https://trello.com/c/0HZlGC | |JP Assignee|yast2-maintainers(a)suse.de |yast-internal(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 697262] namespaces of osc modules clash
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=697262 https://bugzilla.suse.com/show_bug.cgi?id=697262#c1 Daniel Mach <daniel.mach(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |daniel.mach(a)suse.com Resolution|--- |UPSTREAM Assignee|adrian.schroeter(a)suse.com |daniel.mach(a)suse.com --- Comment #1 from Daniel Mach <daniel.mach(a)suse.com> --- We're aware of this and improving it in the latest osc code. We can't fix it at once because many osc users import osc functionality from random places and it would break their code. We need to do it one step at a time while refactoring the osc code. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c11 --- Comment #11 from Marcus Meissner <meissner(a)suse.com> --- We have not yet refreshed the shim for tumbleweed, which is at SBAT level 1. This is pending and WIP. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dennis.tseng(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jsegitz(a)suse.com Assignee|glin(a)suse.com |jlee(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c10 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P1 - Urgent Status|NEW |CONFIRMED CC| |fvogt(a)suse.com, | |julia.faltenbacher(a)suse.com | |, mchang(a)suse.com, | |meissner(a)suse.com Assignee|screening-team-bugs(a)suse.de |glin(a)suse.com Severity|Normal |Critical --- Comment #10 from Fabian Vogt <fvogt(a)suse.com> --- A colleage hit this exact issue after installing updates on a Lenovo laptop running (only) Leap 15.4. No custom kernel. The last update installation updated grub, but unless I somehow missed it in the zypp history, not shim. With SB disabled, the system booted fine and I ran: mokutil --set-verbosity true mokutil --set-sbat-policy delete This didn't fix it, MokManager hit the security violation as well, presumably before doing anything. I also cleared the EFI partition + bootorder and ran "shim-install" and "shim-install --removable --no-nvram" for good measure, no difference. For the time being SB had to be disabled. -- You are receiving this mail because: You are on the CC list for the bug.

1 0