January 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1215701] New: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1215701 Bug ID: 1215701 Summary: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/379815/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: rfrohl(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40581 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1214211] New: "Loading basic drivers" is printed twice on the screen when loading installation system
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1214211 Bug ID: 1214211 Summary: "Loading basic drivers" is printed twice on the screen when loading installation system Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: dheidler(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 868778 --> https://bugzilla.suse.com/attachment.cgi?id=868778&action=edit screenshot Something like this is printed: Loading basic drivers...Loading basic drivers ok Expected: Loading basic drivers... ok -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1216797] New: SeaMonkey fails to build with rust >= 1.48
by bugzilla_noreply＠suse.com 03 Oct '24

03 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1216797 Bug ID: 1216797 Summary: SeaMonkey fails to build with rust >= 1.48 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: CONFIRMED Severity: Normal Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: psychonaut(a)nothingisreal.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- SeaMonkey was failing to build with rust >= 1.48 due to upstream bug <https://bugzilla.mozilla.org/show_bug.cgi?id=1860935>. To fix this issue, I have added a patch to the SeaMonkey 2.53.17.1 packages provided by the mozilla/seamonkey package on OBS: <https://build.opensuse.org/package/show/mozilla/seamonkey>. I am requesting that these changes be included in Leap 15.4 and 15.5. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1218424] New: go1.22 release tracking
by bugzilla_noreply＠suse.com 01 Oct '24

01 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1218424 Bug ID: 1218424 Summary: go1.22 release tracking Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- go1.22 (expected February 2024) is a major release of Go. Minor releases of go1.22.x will be provided through February 2025. This issue tracks go1.22.x releases packaged and submitted initially to openSUSE:Factory and can be referenced in submissions to additional repositories. Go Release Cycle https://github.com/golang/go/wiki/Go-Release-Cycle Go Release history https://golang.org/doc/devel/release.html -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1216083] New: cockpit-ws: theme QA
by bugzilla_noreply＠suse.com 01 Oct '24

01 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1216083 Bug ID: 1216083 Summary: cockpit-ws: theme QA Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: Cockpit-bugs(a)suse.de Reporter: amajer(a)suse.com QA Contact: qa-bugs(a)suse.de CC: Cockpit-bugs(a)suse.de, qa-bugs(a)suse.de Depends on: 1216082 Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1216082 +++ We should add openQA test for basic theme and login -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1216082] New: cockpit-ws: theme missing
by bugzilla_noreply＠suse.com 01 Oct '24

01 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1216082 Bug ID: 1216082 Summary: cockpit-ws: theme missing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: Cockpit-bugs(a)suse.de Reporter: amajer(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The theme seems to not be loaded correcly. It looks very dark, like the default theme. See MicroOS 5.1 for correct theme. TW, 5.5 need fixes. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1219395] New: get-edid segfault
by bugzilla_noreply＠suse.com 30 Sep '24

30 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1219395 Bug ID: 1219395 Summary: get-edid segfault Classification: openSUSE Product: openSUSE Backports Version: SLE-15-SP5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Packages Assignee: packagehub-bugs(a)suse.com Reporter: jiri.belka(a)suse.com QA Contact: packagehub-bugs(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 872339 --> https://bugzilla.suse.com/attachment.cgi?id=872339&action=edit getappcore output read-edid-3.0.2-bp155.3.9.x86_64 sles-release-15.5-150500.43.4.x86_64 avocado:~ # get-edid This is read-edid version 3.0.2. Prepare for some fun. Attempting to use i2c interface Looks like no busses have an EDID. Sorry! Attempting to use the classical VBE interface Illegal instruction (core dumped) avocado:~ # coredumpctl list TIME PID UID GID SIG COREFILE EXE SIZE Wed 2024-01-31 08:07:15 CET 31656 0 0 SIGILL present /usr/bin/get-edid 27.3K Wed 2024-01-31 08:09:05 CET 31755 0 0 SIGILL present /usr/bin/get-edid 27.3K avocado:~ # systool -vc drm | grep -P 'Class Device path = .*drm/card' Class Device path = "/sys/devices/pci0000:00/0000:00:1c.5/0000:02:00.0/0000:03:00.0/drm/card0/card0-VGA-1" Class Device path = "/sys/devices/pci0000:00/0000:00:1c.5/0000:02:00.0/0000:03:00.0/drm/card0" Class Device path = "/sys/devices/pci0000:00/0000:00:1c.5/0000:02:00.0/0000:03:00.0/drm/card0/card0-Virtual-1" avocado:~ # ls -1 /sys/devices/pci0000:00/0000:00:1c.5/0000:02:00.0/0000:03:00.0/drm/card0/card0*/edid /sys/devices/pci0000:00/0000:00:1c.5/0000:02:00.0/0000:03:00.0/drm/card0/card0-VGA-1/edid /sys/devices/pci0000:00/0000:00:1c.5/0000:02:00.0/0000:03:00.0/drm/card0/card0-Virtual-1/edid But, `edid' files do not provide any data, there is no monitor attached to it. ls -1 /sys/devices/pci0000:00/0000:00:1c.5/0000:02:00.0/0000:03:00.0/drm/card0/card0*/edid | xargs -L 1 od -A n -t x1 | wc -l 0 -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1215663] New: # CONFIG_SCHED_AUTOGROUP is not set causes Fossilize INFO: Autogroup scheduling is not enabled on this kernel. Will rely entirely on nice().
by bugzilla_noreply＠suse.com 30 Sep '24

30 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1215663 Bug ID: 1215663 Summary: # CONFIG_SCHED_AUTOGROUP is not set causes Fossilize INFO: Autogroup scheduling is not enabled on this kernel. Will rely entirely on nice(). Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: vvedomil(a)protonmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi, I tried to play over Steam on OpenSUSE Tumbleweed and the terminal reported the following error: Fossilize INFO: Autogroup scheduling is not enabled on this kernel. Will rely entirely on nice(). Autogroup scheduling needs to be enabled during kernel compilation. I checked that on https://github.com/SUSE/kernel-source/blob/15b4ad8fb5f18870bb9e4011a2bb53cb… I can see # CONFIG_SCHED_AUTOGROUP is not set, that's the origin of the issue. So many distros enable that by default and I've never seen this issue with Steam on distros where is set CONFIG_SCHED_AUTOGROUP=y Examples: Arch Linux: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/blob/main… CachyOS: https://github.com/CachyOS/linux-cachyos/blob/1d74c2037cd78f292fb6606708fa8… Could I ask to change that? Change config, build a kernel with CONFIG_SCHED_AUTOGROUP=y, and make the OpenSUSE kernel and the whole distro more friendly to gaming through Steam. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1216851] New: kernel BUG at ../mm/slub.c:379!
by bugzilla_noreply＠suse.com 30 Sep '24

30 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1216851 Bug ID: 1216851 Summary: kernel BUG at ../mm/slub.c:379! Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: x86-64 OS: openSUSE Leap 15.4 Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: obs(a)akr.yagii.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Observed today first time when doing day-to-day work with firefox on a laptop logged in as plain user. Potential dupe #1190482 [226385.604827] kernel BUG at ../mm/slub.c:379! [226385.604844] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [226385.604853] CPU: 4 PID: 765 Comm: irq/176-iwlwifi Kdump: loaded Tainted: G N 5.14.21-150400.24.88-default #1 SLE15-SP4 bd2f624c6b628ccd74aec14e859f7b291002e62d [226385.604866] Hardware name: LENOVO 20W000ATGE/20W000ATGE, BIOS N34ET53W (1.53 ) 08/31/2022 [226385.604872] RIP: 0010:__slab_free+0x2ba/0x4b0 [226385.604884] Code: 85 8e 00 00 00 45 85 c9 0f 84 b6 00 00 00 48 81 c4 88 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d 49 8d 65 f0 41 5d c3 cc cc cc cc <0f> 0b 65 ff 05 fd 17 31 79 f0 49 0f ba 2c 24 00 0f 83 31 ff ff ff [226385.604894] RSP: 0018:ffffb92c80234aa0 EFLAGS: 00010246 [226385.604902] RAX: ffff9ad50daf4070 RBX: 000000008020001a RCX: ffff9ad50daf4000 [226385.604908] RDX: ffff9ad50daf4000 RSI: fffffaff0736bd00 RDI: ffff9ad49b881c00 [226385.604914] RBP: ffffb92c80234b50 R08: 0000000000000001 R09: ffffffff872564b3 [226385.604919] R10: ffff9ad4821d0840 R11: ffff9ad50daf4000 R12: fffffaff0736bd00 [226385.604924] R13: ffff9ad50daf4000 R14: ffff9ad49b881c00 R15: ffff9ad50daf4000 [226385.604930] FS: 0000000000000000(0000) GS:ffff9ad79f500000(0000) knlGS:0000000000000000 [226385.604937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [226385.604942] CR2: 00007f4cc3e6c000 CR3: 0000000159c10006 CR4: 0000000000770ee0 [226385.604949] PKRU: 55555554 [226385.604953] Call Trace: [226385.604958] <IRQ> [226385.604966] ? iwl_mvm_tx_mpdu+0x204/0x580 [iwlmvm 8cc7b51ab5d521e96ea680d180f15f69cb14c62f] [226385.605002] ? kmem_cache_free+0x3c0/0x410 [226385.605011] ? kfree_skb_list+0x13/0x30 [226385.605021] ? kmem_cache_free+0x3c0/0x410 [226385.605029] kmem_cache_free+0x3c0/0x410 [226385.605037] kfree_skb_list+0x13/0x30 [226385.605045] ieee80211_report_used_skb+0xaf/0x490 [mac80211 27f3494b511335547355ff5927e7ac5c52c3181a] [226385.605098] ieee80211_tx_status_ext+0x510/0xb30 [mac80211 27f3494b511335547355ff5927e7ac5c52c3181a] [226385.605145] ieee80211_tx_status+0x7c/0xb0 [mac80211 27f3494b511335547355ff5927e7ac5c52c3181a] [226385.605192] iwl_mvm_tx_reclaim+0x376/0x3f0 [iwlmvm 8cc7b51ab5d521e96ea680d180f15f69cb14c62f] [226385.605224] iwl_mvm_rx_ba_notif+0x187/0x360 [iwlmvm 8cc7b51ab5d521e96ea680d180f15f69cb14c62f] [226385.605251] iwl_mvm_rx_common+0xe3/0x2e0 [iwlmvm 8cc7b51ab5d521e96ea680d180f15f69cb14c62f] [226385.605277] iwl_pcie_rx_handle+0x4db/0x8f0 [iwlwifi 1d7ba350faa5c4a5226540622d76fe15ddc58664] [226385.605309] iwl_pcie_napi_poll_msix+0x29/0xc0 [iwlwifi 1d7ba350faa5c4a5226540622d76fe15ddc58664] [226385.605335] __napi_poll+0x2a/0x180 [226385.605344] net_rx_action+0x24c/0x2a0 [226385.605352] __do_softirq+0xd2/0x2c0 [226385.605360] ? irq_forced_thread_fn+0x80/0x80 [226385.605371] do_softirq+0x71/0x80 [226385.605381] </IRQ> [226385.605385] <TASK> [226385.605389] __local_bh_enable_ip+0x64/0x70 [226385.605398] iwl_pcie_irq_rx_msix_handler+0xc2/0x120 [iwlwifi 1d7ba350faa5c4a5226540622d76fe15ddc58664] [226385.605425] irq_thread_fn+0x1e/0x60 [226385.605437] irq_thread+0xec/0x1a0 [226385.605446] ? wake_threads_waitq+0x30/0x30 [226385.605459] ? irq_thread_check_affinity+0xe0/0xe0 [226385.605468] kthread+0x154/0x180 [226385.605480] ? set_kthread_struct+0x50/0x50 [226385.605492] ret_from_fork+0x1f/0x30 [226385.605507] </TASK> [226385.605513] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast ccm rfcomm xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT xt_tcpudp bridge stp llc cmac algif_hash algif_skcipher af_alg nf_nat_tftp nft_objref af_packet nf_conntrack_tftp nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtable_broute ip6table_nat ip6table_mangle mhi_net(N) ip6table_raw mhi_wwan_ctrl(N) ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle bnep iptable_raw iptable_security ip_set btusb nfnetlink btrtl btbcm btintel uvcvideo bluetooth videobuf2_vmalloc ebtable_filter videobuf2_memops videobuf2_v4l2 videobuf2_common ebtables videodev mc ecdh_generic crc16 ip6table_filter ip6_tables iptable_filter bpfilter dmi_sysfs snd_ctl_led snd_soc_skl_hda_dsp snd_soc_intel_hda_dsp_common snd_soc_hdac_hdmi snd_soc_dmic iTCO_wdt intel_pmc_bxt [226385.605600] nls_iso8859_1 iTCO_vendor_support mei_hdcp(N) mfd_core nls_cp437 intel_rapl_msr snd_hda_codec_hdmi vfat snd_hda_codec_realtek fat snd_hda_codec_generic intel_tcc_cooling(N) xfs snd_sof_pci_intel_tgl snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match x86_pkg_temp_thermal snd_soc_acpi intel_powerclamp iwlmvm kvm_intel soundwire_bus snd_soc_core mac80211 kvm libarc4 snd_compress irqbypass snd_pcm_dmaengine joydev think_lmi(N) mhi_pci_generic(N) efi_pstore(N) pcspkr snd_hda_intel wmi_bmof firmware_attributes_class(N) ucsi_acpi mhi(N) typec_ucsi snd_intel_dspcfg typec snd_intel_sdw_acpi roles thermal iwlwifi snd_hda_codec thinkpad_acpi snd_hda_core ledtrig_audio cfg80211 snd_hwdep platform_profile ac int3403_thermal snd_pcm processor_thermal_device_pci_legacy(N) processor_thermal_device snd_timer i2c_i801 [226385.605696] processor_thermal_rfim processor_thermal_mbox processor_thermal_rapl mei_me e1000e intel_rapl_common snd intel_hid(N) int340x_thermal_zone sparse_keymap mei soundcore intel_pmc_core i2c_smbus rfkill acpi_tad(N) intel_soc_dts_iosf(N) int3400_thermal igen6_edac acpi_thermal_rel acpi_pad button fuse configfs ip_tables x_tables dm_crypt essiv authenc i915 crc32_pclmul i2c_algo_bit ttm ghash_clmulni_intel drm_kms_helper syscopyarea sysfillrect aesni_intel nvme xhci_pci xhci_pci_renesas xhci_hcd crypto_simd sysimgblt fb_sys_fops sdhci_pci cec rc_core cqhci cryptd sdhci drm mmc_core usbcore nvme_core serio_raw nvme_common t10_pi wmi battery video pinctrl_tigerlake btrfs blake2b_generic libcrc32c crc32c_intel xor raid6_pq coretemp sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod msr efivarfs [226385.605820] Supported: No, Unsupported modules are loaded -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1218694] New: [k8s,kube-flannel] YAML File to set up Flannel Network Add-On is outdated
by bugzilla_noreply＠suse.com 25 Sep '24

25 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1218694 Bug ID: 1218694 Summary: [k8s,kube-flannel] YAML File to set up Flannel Network Add-On is outdated Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: eich(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: Development Blocker: --- After successfully setting up k8s (using `kubeadm init`), the coredns pod remains in a 'Pending' state: NAMESPACE NAME READY STATUS RESTARTS AG kube-system coredns-86ccd44ff8-24h9w 0/1 Pending 0 12 kube-system coredns-86ccd44ff8-rz5vq 0/1 Pending 0 12 kube-system etcd-k8s-head 1/1 Running 1 12 kube-system kube-apiserver-k8s-head 1/1 Running 1 12 kube-system kube-controller-manager-k8s-head 1/1 Running 1 12 kube-system kube-proxy-qprnj 1/1 Running 0 12 kube-system kube-scheduler-k8s-head 1/1 Running 1 13 This is due to a not yet installed network plugin. When installing `kubeadm` thru 'patterns-kubernetes-kubeadm', the package 'flannel-k8s-yaml' is installed alongside which contains a yaml file to set up Flannel as network plugin. Running `kubectl apply -f /usr/share/k8s-yaml/flannel/kube-flannel.yaml` using the supplied file fails, however after: | clusterrole.rbac.authorization.k8s.io/flannel created | clusterrolebinding.rbac.authorization.k8s.io/flannel created | serviceaccount/flannel created | configmap/kube-flannel-cfg created | daemonset.apps/kube-flannel-ds created with the error: | error: resource mapping not found for name: "psp.flannel.unprivileged" namespace: "" from "/usr/share/k8s-yaml/flannel/kube-flannel.yaml": no matches for kind "PodSecurityPolicy" in version "policy/v1beta1" ensure CRDs are installed first When using the yaml file from https://github.com/flannel-io/flannel/blob/master/Documentation/kube-flanne… (wget https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/k…) it works, however, the flannel pod is still cycling thru a CrashLoopBackOff - it fails with (from log): | E0110 11:46:48.988799 1 main.go:332] Error registering network: failed to acquire lease: node "k8s-head" pod cidr not assigned -- You are receiving this mail because: You are on the CC list for the bug.

1 8