August 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1213595] New: Live ISO does not creates Persistent storage
by bugzilla_noreply＠suse.com 22 Apr '24

22 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213595 Bug ID: 1213595 Summary: Live ISO does not creates Persistent storage Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Live Medium Assignee: fvogt(a)suse.com Reporter: sehsuvarselmanoglu(a)hotmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868398 --> https://bugzilla.suse.com/attachment.cgi?id=868398&action=edit 7z File for some logs Hi, I downloaded OpenSUSE Leap ISO (openSUSE-Leap-15.5-KDE-Live-x86_64-Build10.40-Media.iso) at 08/06/2023 (as soon as released) then I “dd” to USB stick and plugged to computer and it worked fine. At first boot, it did create the persistent storage cow (boot.log : [ 22.002982] dracut-initqueue[877]: mke2fs 1.46.4 (18-Aug-2021) ) Few days later I download again this time build number was different (openSUSE-Leap-15.5-KDE-Live-x86_64-Build10.57-Media.iso). At first boot, it did not create persistent storage. dracut says (boot.log : [ 21.489260] dracut-initqueue[769]: Warning: Falling back to temporary overlay) same as the new release (openSUSE-Leap-15.5-KDE-Live-x86_64-Build10.73-Media.iso) Any release after 10.40 does not creates persistent storage (neither 10.53 nor 10.73) I tried with different CPU (AMD, Core Duo, I5) and different USB stick (4GB 8GB 16GB and 32GB) even with different port (USB2 USB3) with different USB s and so on. No matter what I tried don't work. Releases after 10.40 (10.57 or 10.73) do not creates the persistent storage. So I open discussion on the forums.opensuse.org and someone suggested that I need to open bug report. and he/she wrote "It is not something you can fix without recreating initrd. The script that is used here comes from kiwi dracut module.". I also add the 7zip file for each ISO "....10.40", "...10.57", "...10.73" that contains some log files. "boot.log" : "sudo cp /var/log/boot.log" "boot.msg" : "cp /var/log/boot.msg" "dmesg.txt" : Output of "dmesg" right after the first boot "fdisk.txt" : 0utput of "fdisk -l" right after first boot "journal.txt" : Output of "sudo journalctl --no-pager --full -b" Thank you very much. -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1213371] New: Dolphin cannot display HEIC images
by bugzilla_noreply＠suse.com 19 Apr '24

19 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213371 Bug ID: 1213371 Summary: Dolphin cannot display HEIC images Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: f.alexander.wilms(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Dolphin does not show thumbnails for .heic files. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1213073] New: clang13-devel from Backports not installable on SLES 15 SP5
by bugzilla_noreply＠suse.com 18 Apr '24

18 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213073 Bug ID: 1213073 Summary: clang13-devel from Backports not installable on SLES 15 SP5 Classification: openSUSE Product: openSUSE Backports Version: SLE-15-SP5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Packages Assignee: packagehub-bugs(a)suse.com Reporter: amoog(a)psi.de QA Contact: packagehub-bugs(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Trying to install clang13-devel from the Backports repository results in: :~ -> sudo zypper install clang13-devel Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides 'clang-tools >= 13.0.1' needed by the to be installed clang13-devel-13.0.1-bp155.6.38.x86_64 Solution 1: do not install clang13-devel-13.0.1-bp155.6.38.x86_64 Solution 2: break clang13-devel-13.0.1-bp155.6.38.x86_64 by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c/d/?] (c): ^C Is there some other repository I am missing? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1213159] New: [request] Lock root account by default
by bugzilla_noreply＠suse.com 17 Apr '24

17 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213159 Bug ID: 1213159 Summary: [request] Lock root account by default Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: milachew(a)mail.lv QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since MicroOS aims to keep administration as small as possible, it makes sense to consider blocking root account by default. Original comment: https://www.reddit.com/r/openSUSE/comments/14u7ka1/comment/jr60ogz/?utm_sou… P.S. By the way, there have already been similar discussions, but regarding ALP: https://bugzilla.opensuse.org/show_bug.cgi?id=1203978 -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1214027] New: All user may connect to this network should not be enable by default
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214027 Bug ID: 1214027 Summary: All user may connect to this network should not be enable by default Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: cosmin.tanczel(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Whenever a new connection is created using the network manager applet in KDE, the option "All user may connect to this network" should not be enabled by default. Reasoning: 1. Security - there are users that just input the root password so the created connection is available for everybody, even though this should not be the case. (I know, if the user has root access he should know what he's doing, but still) 2. Unnecessary step in the creation of a new connection process. Might be there is a reasoning to have it enabled by default, so please let me know if this is the case. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1214176] New: VUL-0: CVE-2023-39959: nextcloud: calendar or address book existence leak via DAV
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214176 Bug ID: 1214176 Summary: VUL-0: CVE-2023-39959: nextcloud: calendar or address book existence leak via DAV Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374996/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39959 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39959 https://www.cve.org/CVERecord?id=CVE-2023-39959 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g… https://github.com/nextcloud/server/pull/38747 https://hackerone.com/reports/1832126 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214175] New: VUL-0: CVE-2023-39958: nextcloud: missing bruteforce protection for client secrets of configured OAuth2 clients
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214175 Bug ID: 1214175 Summary: VUL-0: CVE-2023-39958: nextcloud: missing bruteforce protection for client secrets of configured OAuth2 clients Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374995/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39958 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39958 https://www.cve.org/CVERecord?id=CVE-2023-39958 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v… https://github.com/nextcloud/server/pull/38773 https://hackerone.com/reports/1258448 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214177] New: VUL-0: CVE-2023-39961: nextcloud: image download restriction bypass
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214177 Bug ID: 1214177 Summary: VUL-0: CVE-2023-39961: nextcloud: image download restriction bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374997/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39961 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39961 https://www.cve.org/CVERecord?id=CVE-2023-39961 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q… https://github.com/nextcloud/text/pull/4481 https://hackerone.com/reports/1965156 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214178] New: VUL-0: CVE-2023-39962: nextcloud: unrestricted external storage deletion
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214178 Bug ID: 1214178 Summary: VUL-0: CVE-2023-39962: nextcloud: unrestricted external storage deletion Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374998/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39962 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. As a workaround, disable app files_external. This also makes the external storage inaccessible but retains the configurations until a patched version has been deployed. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39962 https://www.cve.org/CVERecord?id=CVE-2023-39962 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… https://github.com/nextcloud/server/pull/39323 https://hackerone.com/reports/2047168 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214179] New: VUL-0: CVE-2023-39963: nextcloud: missing password check allows attackers to add app passwords on compromised accounts
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214179 Bug ID: 1214179 Summary: VUL-0: CVE-2023-39963: nextcloud: missing password check allows attackers to add app passwords on compromised accounts Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374999/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39963 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39963 https://www.cve.org/CVERecord?id=CVE-2023-39963 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j… https://github.com/nextcloud/server/pull/39416 https://hackerone.com/reports/2067572 -- You are receiving this mail because: You are on the CC list for the bug.

1 1