July 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1213006] New: VUL-0: CVE-2023-34457: python-MechanicalSoup: malicious web server can read arbitrary files on client using file input inside HTML form
by bugzilla_noreply＠suse.com 07 Dec '23

07 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1213006 Bug ID: 1213006 Summary: VUL-0: CVE-2023-34457: python-MechanicalSoup: malicious web server can read arbitrary files on client using file input inside HTML form Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: toddrme2178(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-34457 A malicious web server can read arbitrary files on the client using a <input type="file" ...> inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. https://github.com/MechanicalSoup/MechanicalSoup/security/advisories/GHSA-x… References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-34457 https://bugzilla.redhat.com/show_bug.cgi?id=2219755 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1212932] New: sddm 0.20 puts $XAUTHORITY in /tmp instead of $XDG_RUNTIME_DIR
by bugzilla_noreply＠suse.com 06 Dec '23

06 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1212932 Bug ID: 1212932 Summary: sddm 0.20 puts $XAUTHORITY in /tmp instead of $XDG_RUNTIME_DIR Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: arvidjaar(a)gmail.com QA Contact: qa-bugs(a)suse.de CC: fabian(a)ritter-vogt.de Target Milestone: --- Found By: --- Blocker: --- user@uefi:~> rpm -q sddm sddm-0.20.0-1.1.x86_64 user@uefi:~> env | grep XAUTHORITY XAUTHORITY=/tmp/xauth_srfSMD user@uefi:~> This is likely due to commit eb4a7d564cd9385d089ec9ff4ce68042d31ee93c Author: Fabian Vogt <fabian(a)ritter-vogt.de> Date: Sat Feb 4 21:11:53 2023 +0100 Use QTemporaryFile with xauth_XXXXXX ih XAuth Use proper temporary files instead of UUIDs. This makes the file's purpose more obvious and also takes care of cleanup. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1213219] New: mariadb: fails to build against fmt 10.0
by bugzilla_noreply＠suse.com 06 Dec '23

06 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1213219 Bug ID: 1213219 Summary: mariadb: fails to build against fmt 10.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: danilo.spinella(a)suse.com Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868149 --> https://bugzilla.suse.com/attachment.cgi?id=868149&action=edit mariadb ftbs with fmt 10 fmt 10.0 has been submitted for inclusion into Factory. During the staging process we have observed mariadb failing to build, I'm attaching the full log. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1213796] New: java-20-openjdk fails to compile in 2034
by bugzilla_noreply＠suse.com 04 Dec '23

04 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1213796 Bug ID: 1213796 Summary: java-20-openjdk fails to compile in 2034 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Java Assignee: java-maintainers(a)suse.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: fstrba(a)suse.com Target Milestone: --- Found By: --- Blocker: --- While working on reproducible builds for openSUSE, I found that our java-20-openjdk package fails to compile in 2034 to reproduce: osc co openSUSE:Factory/java-20-openjdk && cd $_ osc build --clean --noservice -j1 --vm-type=kvm \ --build-opt=--vm-custom-opt="-rtc base=2034-02-02T00:00:00" \ standard x86_64 [ 284s] /usr/lib64/jvm/java/bin/java -XX:+UseSerialGC -Xms32M -Xmx512M -XX:TieredStopAtLevel=1 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/configure-support/classes.jsa -Xshare:auto -cp /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/buildtools/jdk_tools_classes build.tools.generatecharacter.CharacterName /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/src/java.base/share/data/unicodedata/UnicodeData.txt /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/jdk/modules/java.base/java/lang/uniName.dat [ 284s] /usr/bin/rm -f /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/jdk/modules/java.base/java/util/currency.data [ 284s] /usr/lib64/jvm/java/bin/java -XX:+UseSerialGC -Xms32M -Xmx512M -XX:TieredStopAtLevel=1 -Duser.language=en -Duser.country=US -XX:+UnlockDiagnosticVMOptions -XX:-VerifySharedSpaces -XX:SharedArchiveFile=/home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/configure-support/classes.jsa -Xshare:auto -cp /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/buildtools/jdk_tools_classes build.tools.generatecurrencydata.GenerateCurrencyData -o /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/jdk/modules/java.base/java/util/currency.data.tmp -i /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/src/java.base/share/data/currency/CurrencyData.properties [ 285s] Error: time is more than 10 years from present: 1672527600000 [ 285s] java.lang.RuntimeException: time is more than 10 years from present: 1672527600000 [ 285s] at build.tools.generatecurrencydata.GenerateCurrencyData.makeSpecialCaseEntry(GenerateCurrencyData.java:315) [ 285s] at build.tools.generatecurrencydata.GenerateCurrencyData.buildMainAndSpecialCaseTables(GenerateCurrencyData.java:254) [ 285s] at build.tools.generatecurrencydata.GenerateCurrencyData.main(GenerateCurrencyData.java:185) [ 285s] gmake[3]: *** [Gendata.gmk:55: /home/abuild/rpmbuild/BUILD/jdk20u-jdk-20.0.1-9/build/jdk/modules/java.base/java/util/currency.data] Error 1 [ 285s] gmake[2]: *** [make/Main.gmk:147: java.base-gendata] Error 2 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1212897] New: Produce separate Aeon installation media
by bugzilla_noreply＠suse.com 28 Nov '23

28 Nov '23

https://bugzilla.suse.com/show_bug.cgi?id=1212897 Bug ID: 1212897 Summary: Produce separate Aeon installation media Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: rbrown(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Aeon requires install media separate from MicroOS -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1213339] New: Segmentation fault when setting up database with sqlite3 gda-control-center-6.0
by bugzilla_noreply＠suse.com 27 Nov '23

27 Nov '23

https://bugzilla.suse.com/show_bug.cgi?id=1213339 Bug ID: 1213339 Summary: Segmentation fault when setting up database with sqlite3 gda-control-center-6.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: vojta.kottas(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Build Identifier: When setting up a sqlite database using gda-control-center-6.0 as a test in a folder (/tmp/test_db in my case), the gui crashed and the command line showed that a segmentation fault had occurred. This issue does not happen on other distros. Reproducible: Always Steps to Reproduce: 1. Run gda-control-center-6.0 2. Set up database with sqlite Actual Results: Segmentation fault Expected Results: A database is set up in the specified folder. This all came from me trying to install the Pano extension, which upon install crashed the gnome-shell. I tracked the issue to this github issue: https://github.com/oae/gnome-shell-pano/issues/178 Which further tracks the issue down to a problem with the sqlite3 package on openSUSE. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1212958] New: evolution hogging CP?U
by bugzilla_noreply＠suse.com 27 Nov '23

27 Nov '23

https://bugzilla.suse.com/show_bug.cgi?id=1212958 Bug ID: 1212958 Summary: evolution hogging CP?U Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When evolution is open fan keeps spinning. It order of magnitude more cpu time than 3 browsers each with number of tabs open together. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1213608] New: "./Inkscape-0e150ed-x86_64.AppImage --appimage-mount" behaves strangely
by bugzilla_noreply＠suse.com 20 Nov '23

20 Nov '23

https://bugzilla.suse.com/show_bug.cgi?id=1213608 Bug ID: 1213608 Summary: "./Inkscape-0e150ed-x86_64.AppImage --appimage-mount" behaves strangely Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: Ulrich.Windl(a)rz.uni-regensburg.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Trying the new Inkscape 1.3 as appimage, I used "./Inkscape-0e150ed-x86_64.AppImage --appimage-mount" to mount the image as root, and that seems to succeed with message "/tmp/.mount_InkscaYEqRgu". However when I try to access that directory from another terminal I only get "permission denied, even for "ls -d": > ll /tmp/.mount_InkscaYEqRgu ls: cannot access '/tmp/.mount_InkscaYEqRgu': Permission denied > ll -d /tmp/.mount_InkscaYEqRgu ls: cannot access '/tmp/.mount_InkscaYEqRgu': Permission denied Oddly, the directory exists, because I can access it as root: # ll /tmp/.mount_InkscaYEqRgu insgesamt 100 -rwxr-xr-x 1 root root 3075 21. Jul 14:26 AppRun -rw-r--r-- 1 root root 40270 21. Jul 14:27 .DirIcon drwxr-xr-x 5 root root 0 26. Mai 16:05 etc drwxr-xr-x 4 root root 0 8. Jul 2021 lib drwxr-xr-x 2 root root 0 21. Jul 14:27 lib64 -rw-r--r-- 1 root root 19274 21. Jul 14:27 org.inkscape.Inkscape.desktop -rw-r--r-- 1 root root 40270 21. Jul 14:26 org.inkscape.Inkscape.png drwxr-xr-x 6 root root 0 8. Jul 2021 usr The problem seems to be this (from stace): statx(AT_FDCWD, "/tmp/.mount_InkscaYEqRgu", AT_STATX_SYNC_AS_STAT|AT_SYMLINK_NOFOLLOW, STATX_MODE|STATX_NLINK|STATX_UID|STATX_GID|STATX_MTIME|STATX_SIZE, 0x7fff110a3fb0) = -1 EACCES (Permission denied) When trying to use the appimage as non-root, it won't work either: > ./Inkscape-0e150ed-x86_64.AppImage fuse: failed to exec fusermount: Permission denied Cannot mount AppImage, please check your FUSE setup. You might still be able to extract the contents of this AppImage if you run it with the --appimage-extract option. See https://github.com/AppImage/AppImageKit/wiki/FUSE for more information open dir error: No such file or directory -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1213702] New: VUL-0: CVE-2023-38285: modsecurity: DoS Vulnerability in Four Transformations
by bugzilla_noreply＠suse.com 13 Nov '23

13 Nov '23

https://bugzilla.suse.com/show_bug.cgi?id=1213702 Bug ID: 1213702 Summary: VUL-0: CVE-2023-38285: modsecurity: DoS Vulnerability in Four Transformations Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Apache Assignee: apache-bugs(a)suse.de Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Vulnerability Details Included in ModSecurity functionality are dozens of transformation actions which support altering the representation of values so that further processing can be done on the modified values. This may be either more convenient to work with, or less prone to rule evasion. The ModSecurity team was recently alerted to a possible DoS issue in four of these transformations in ModSecurity v3. Thanks to the reporter for the investigation and for responsibly disclosing the issue. The affected transformations are: removeWhitespace, removeNull, replaceNull, and removeCommentsChar. The affected transformations were functionally correct. However, the implemented solutions would be inefficient if a malicious user were to submit a specially crafted HTTP request that triggered worst-case performance. The most dramatic delays can typically be prevented through common configuration items such as SecRequestBodyNoFilesLimit with the default value of 131072 suggested in modsecurity.conf-recommended. However, even with this limit in place, a dozen or more executions of these transformations could result in multiple seconds of delay for a single HTTP transaction. If a large enough number of such malicious requests are running simultaneously, this could render the webserver unable to respond to legitimate requests in a timely manner. Mitigation For installations where immediate upgrade to the new version of the software is impractical, some mitigation possibilities are available. The nature of the issue results in large values causing a much greater effect on resources than numerous smaller values. A separate ModSecurity rule could be included to limit the size of each value to be processed, but still allow legitimate content to be processed unimpeded. For example, if there are many rules with the affected transformations executing against the ARGS collection, a rule such as the following could be included before other phase 2 rules: SecRule ARGS "@gt 16000" "id:1,phase:2,t:length,deny,status:403,msg:’ARG exceeds length limit'" Optionally, combined with further reducing the configured value for SecRequestBodyNoFilesLimit, potential delays precipitated by worst-case input can be significantly reduced. References https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity… https://github.com/SpiderLabs/ModSecurity/commit/ab5658f2d4cfa5126db256cf3f… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1213048] New: telegram-desktop cannot start
by bugzilla_noreply＠suse.com 31 Oct '23

31 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1213048 Bug ID: 1213048 Summary: telegram-desktop cannot start Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: 64bit OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce(a)forge.provo.novell.com Reporter: diegops(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Fresh 15.5 with XFCE. telegram-desktop 4.7.1 diego@localhost:~$ telegram-desktop Cannot connect to server socket err = No existe el fichero o el directorio Cannot connect to server request channel jack server is not running or cannot be started JackShmReadWritePtr::~JackShmReadWritePtr - Init not done for -1, skipping unlock JackShmReadWritePtr::~JackShmReadWritePtr - Init not done for -1, skipping unlock QPainter::begin: Paint device returned engine == 0, type: 2 QWidget::render: Cannot render with an inactive painter Abortado (`core' generado) diego@localhost:~$ -- You are receiving this mail because: You are on the CC list for the bug.

1 21