September 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1213500] New: [trackerbug] docker 24.0.4-ce update
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1213500 Bug ID: 1213500 Summary: [trackerbug] docker 24.0.4-ce update Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: asarai(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1213537] New: myrb / myrs drivers cause hang on boot when using a Mylex AcceleRAID 170 (DAC960)
by bugzilla_noreply＠suse.com 30 Apr '24

30 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213537 Bug ID: 1213537 Summary: myrb / myrs drivers cause hang on boot when using a Mylex AcceleRAID 170 (DAC960) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: medwards-suse(a)mirkwood.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868350 --> https://bugzilla.suse.com/attachment.cgi?id=868350&action=edit dmesg Booting opensuse leap 15.5 fails on this machine - shortly after the myrb and myrs drivers load and detect the AcceleRAID 170 and drives connected to this card, booting simply stops. Waiting for a few minutes will let me see kernel warnings about hung processes, but booting never completes at this point. Adding modprobe.blacklist=myrb and modprobe.blacklist=myrs to the kernel commandline lets boot complete, though obviously without the AcceleRAID card in use. Once booted, I was able to enable dyndbg for these two drivers: # for d in myr{s,b}; do echo 'file drivers/scsi/${d}.c +p' > /sys/kernel/debug/dynamic_debug/control; done Loading the drivers manually caused the modprobe for myrs to hang (myrb loaded w/o issue), leading me to believe the problem lies within the myrs driver. dyndbg of myrb + myrs: drivers/scsi/myrs.c:2114 [myrs]myrs_monitor =_ "monitor tick\012" drivers/scsi/myrs.c:1822 [myrs]myrs_slave_alloc =_ "Logical device mapping %d:%d:%d -> %d\012" drivers/scsi/myrs.c:471 [myrs]myrs_get_fwstatus =_ "Sending GetHealthStatus\012" drivers/scsi/myrs.c:338 [myrs]myrs_get_pdev_info =_ "Sending GetPhysicalDeviceInfoValid for pdev %d:%d:%d\012" drivers/scsi/myrs.c:249 [myrs]myrs_get_ldev_info =_ "Sending GetLogicalDeviceInfoValid for ldev %d\012" drivers/scsi/myrs.c:189 [myrs]myrs_get_ctlr_info =_ "Sending GetControllerInfo\012" drivers/scsi/myrb.c:2445 [myrb]myrb_monitor =_ "reschedule monitor\012" drivers/scsi/myrb.c:2436 [myrb]myrb_monitor =_ "new enquiry\012" drivers/scsi/myrb.c:2432 [myrb]myrb_monitor =_ "get background init status\012" drivers/scsi/myrb.c:2427 [myrb]myrb_monitor =_ "get consistency check progress\012" drivers/scsi/myrb.c:2421 [myrb]myrb_monitor =_ "get rebuild progress\012" drivers/scsi/myrb.c:2415 [myrb]myrb_monitor =_ "get logical drive info\012" drivers/scsi/myrb.c:2409 [myrb]myrb_monitor =_ "get rebuild progress\012" drivers/scsi/myrb.c:2403 [myrb]myrb_monitor =_ "get error table\012" drivers/scsi/myrb.c:2397 [myrb]myrb_monitor =_ "get event log no %d/%d\012" drivers/scsi/myrb.c:2390 [myrb]myrb_monitor =_ "monitor tick\012" drivers/scsi/myrb.c:2360 [myrb]myrb_handle_scsi =_ "Device nonresponsive\012" drivers/scsi/myrb.c:2355 [myrb]myrb_handle_scsi =_ "Attempt to Access Beyond End of Logical Drive" drivers/scsi/myrb.c:2350 [myrb]myrb_handle_scsi =_ "Logical Drive Nonexistent or Offline" drivers/scsi/myrb.c:2331 [myrb]myrb_handle_scsi =_ "Bad Data Encountered\012" drivers/scsi/myrb.c:1699 [myrb]myrb_pdev_slave_alloc =_ "slave alloc pdev %d:%d state %x\012" drivers/scsi/myrb.c:1693 [myrb]myrb_pdev_slave_alloc =_ "device not present, skip\012" drivers/scsi/myrb.c:1687 [myrb]myrb_pdev_slave_alloc =_ "Failed to get device state, status %x\012" drivers/scsi/myrb.c:1639 [myrb]myrb_ldev_slave_alloc =_ "slave alloc ldev %d state %x\012" drivers/scsi/myrb.c:1438 [myrb]myrb_ldev_queuecommand =_ "ldev %u in state %x, skip\012" drivers/scsi/myrb.c:1414 [myrb]myrb_read_capacity =_ "Capacity %u, blocksize %u\012" See attachment for dmesg output. myrs was loaded around timestamp 16372.039529. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1214980] New: mozilla-nss: FTBFS because expired certificate since 2023-09-04
by bugzilla_noreply＠suse.com 29 Apr '24

29 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214980 Bug ID: 1214980 Summary: mozilla-nss: FTBFS because expired certificate since 2023-09-04 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- mozilla-nss doesn't build because because expired certificate since 2023-09-04 Bernhard M. Wiedemann already made a nice report at upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1813401 A fix in progress: https://phabricator.services.mozilla.com/D185088 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1213371] New: Dolphin cannot display HEIC images
by bugzilla_noreply＠suse.com 19 Apr '24

19 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213371 Bug ID: 1213371 Summary: Dolphin cannot display HEIC images Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: f.alexander.wilms(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Dolphin does not show thumbnails for .heic files. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1213073] New: clang13-devel from Backports not installable on SLES 15 SP5
by bugzilla_noreply＠suse.com 18 Apr '24

18 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213073 Bug ID: 1213073 Summary: clang13-devel from Backports not installable on SLES 15 SP5 Classification: openSUSE Product: openSUSE Backports Version: SLE-15-SP5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Packages Assignee: packagehub-bugs(a)suse.com Reporter: amoog(a)psi.de QA Contact: packagehub-bugs(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Trying to install clang13-devel from the Backports repository results in: :~ -> sudo zypper install clang13-devel Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides 'clang-tools >= 13.0.1' needed by the to be installed clang13-devel-13.0.1-bp155.6.38.x86_64 Solution 1: do not install clang13-devel-13.0.1-bp155.6.38.x86_64 Solution 2: break clang13-devel-13.0.1-bp155.6.38.x86_64 by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c/d/?] (c): ^C Is there some other repository I am missing? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1213159] New: [request] Lock root account by default
by bugzilla_noreply＠suse.com 17 Apr '24

17 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213159 Bug ID: 1213159 Summary: [request] Lock root account by default Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: milachew(a)mail.lv QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since MicroOS aims to keep administration as small as possible, it makes sense to consider blocking root account by default. Original comment: https://www.reddit.com/r/openSUSE/comments/14u7ka1/comment/jr60ogz/?utm_sou… P.S. By the way, there have already been similar discussions, but regarding ALP: https://bugzilla.opensuse.org/show_bug.cgi?id=1203978 -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1214027] New: All user may connect to this network should not be enable by default
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214027 Bug ID: 1214027 Summary: All user may connect to this network should not be enable by default Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: cosmin.tanczel(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Whenever a new connection is created using the network manager applet in KDE, the option "All user may connect to this network" should not be enabled by default. Reasoning: 1. Security - there are users that just input the root password so the created connection is available for everybody, even though this should not be the case. (I know, if the user has root access he should know what he's doing, but still) 2. Unnecessary step in the creation of a new connection process. Might be there is a reasoning to have it enabled by default, so please let me know if this is the case. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1214176] New: VUL-0: CVE-2023-39959: nextcloud: calendar or address book existence leak via DAV
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214176 Bug ID: 1214176 Summary: VUL-0: CVE-2023-39959: nextcloud: calendar or address book existence leak via DAV Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374996/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39959 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39959 https://www.cve.org/CVERecord?id=CVE-2023-39959 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g… https://github.com/nextcloud/server/pull/38747 https://hackerone.com/reports/1832126 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214175] New: VUL-0: CVE-2023-39958: nextcloud: missing bruteforce protection for client secrets of configured OAuth2 clients
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214175 Bug ID: 1214175 Summary: VUL-0: CVE-2023-39958: nextcloud: missing bruteforce protection for client secrets of configured OAuth2 clients Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374995/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39958 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39958 https://www.cve.org/CVERecord?id=CVE-2023-39958 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v… https://github.com/nextcloud/server/pull/38773 https://hackerone.com/reports/1258448 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214177] New: VUL-0: CVE-2023-39961: nextcloud: image download restriction bypass
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214177 Bug ID: 1214177 Summary: VUL-0: CVE-2023-39961: nextcloud: image download restriction bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374997/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39961 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39961 https://www.cve.org/CVERecord?id=CVE-2023-39961 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q… https://github.com/nextcloud/text/pull/4481 https://hackerone.com/reports/1965156 -- You are receiving this mail because: You are on the CC list for the bug.

1 1