January 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1218701] New: llvm17 on i586: fails to build with RPM 4.19
by bugzilla_noreply＠suse.com 29 Apr '24

29 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218701 Bug ID: 1218701 Summary: llvm17 on i586: fails to build with RPM 4.19 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 871750 --> https://bugzilla.suse.com/attachment.cgi?id=871750&action=edit llvm17 on i586 with RPM 4.19 The remaining blocker for RPM 4.19 to go is llvm17 failing to build on i586, please see attached log. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1218680] New: VUL-0: CVE-2022-36765: EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise ...
by bugzilla_noreply＠suse.com 26 Apr '24

26 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218680 Bug ID: 1218680 Summary: VUL-0: CVE-2022-36765: EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise ... Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/390490/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-36765 https://www.cve.org/CVERecord?id=CVE-2022-36765 https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1218887] New: VUL-0: CVE-2023-45237: edk2, ovmf: Use of a Weak PseudoRandom Number Generator
by bugzilla_noreply＠suse.com 25 Apr '24

25 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218887 Bug ID: 1218887 Summary: VUL-0: CVE-2023-45237: edk2, ovmf: Use of a Weak PseudoRandom Number Generator Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/391385/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45237 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h https://www.cve.org/CVERecord?id=CVE-2023-45237 http://www.openwall.com/lists/oss-security/2024/01/16/2 https://bugzilla.redhat.com/show_bug.cgi?id=2258706 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1218158] New: yast-nfs-server hardcoded configuration file /etc/idmapd.conf
by bugzilla_noreply＠suse.com 23 Apr '24

23 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218158 Bug ID: 1218158 Summary: yast-nfs-server hardcoded configuration file /etc/idmapd.conf Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: ana.guerrero(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- nfs-client has moved its default configuration files from /etc to /usr/etc yast-nfs-server is expecting to find the default file at /etc/idmapd.conf see: https://github.com/yast/yast-nfs-server/blob/a7714580ccd9c6e2e4acdc62c4e0dd… and it fails, you can see it in this test: https://openqa.opensuse.org/tests/3819034#step/yast2_nfs_server/28 For reference, see: https://bugzilla.opensuse.org/show_bug.cgi?id=1216740 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1217488] New: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY
by bugzilla_noreply＠suse.com 23 Apr '24

23 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1217488 Bug ID: 1217488 Summary: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Filesystems Assignee: nfbrown(a)suse.com Reporter: petr.vorel(a)suse.com QA Contact: petr.vorel(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Although we start due #1217128 testing via cdmackay/pynfs.git, which has fix for "nfs4lib.BadCompoundRes: operation OP_SETCLIENTID should return NFS4_OK [1], instead got NFS4ERR_DELAY", we still get 9 tests failing with this error on Tumbleweed. Any idea what could be wrong now? O I can ask Calum Mackay on linux-nfs if you're busy with more important stuff. [1] https://git.linux-nfs.org/?p=cdmackay/pynfs.git;a=commit;h=0d4d3fd0bb7a6386… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1216740] New: nfs-client: move config to /usr
by bugzilla_noreply＠suse.com 22 Apr '24

22 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1216740 Bug ID: 1216740 Summary: nfs-client: move config to /usr Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: nfbrown(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- nfs-client ships several (sample) config files in /etc. Those should be removed nowadays. Just package the samples as %doc. The relevant ones should be shipped in /usr (e.g /usr/etc) instead. Bonus points for also supporting drop-ins. See also tracker bug 1208319 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1213595] New: Live ISO does not creates Persistent storage
by bugzilla_noreply＠suse.com 22 Apr '24

22 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213595 Bug ID: 1213595 Summary: Live ISO does not creates Persistent storage Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Live Medium Assignee: fvogt(a)suse.com Reporter: sehsuvarselmanoglu(a)hotmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868398 --> https://bugzilla.suse.com/attachment.cgi?id=868398&action=edit 7z File for some logs Hi, I downloaded OpenSUSE Leap ISO (openSUSE-Leap-15.5-KDE-Live-x86_64-Build10.40-Media.iso) at 08/06/2023 (as soon as released) then I “dd” to USB stick and plugged to computer and it worked fine. At first boot, it did create the persistent storage cow (boot.log : [ 22.002982] dracut-initqueue[877]: mke2fs 1.46.4 (18-Aug-2021) ) Few days later I download again this time build number was different (openSUSE-Leap-15.5-KDE-Live-x86_64-Build10.57-Media.iso). At first boot, it did not create persistent storage. dracut says (boot.log : [ 21.489260] dracut-initqueue[769]: Warning: Falling back to temporary overlay) same as the new release (openSUSE-Leap-15.5-KDE-Live-x86_64-Build10.73-Media.iso) Any release after 10.40 does not creates persistent storage (neither 10.53 nor 10.73) I tried with different CPU (AMD, Core Duo, I5) and different USB stick (4GB 8GB 16GB and 32GB) even with different port (USB2 USB3) with different USB s and so on. No matter what I tried don't work. Releases after 10.40 (10.57 or 10.73) do not creates the persistent storage. So I open discussion on the forums.opensuse.org and someone suggested that I need to open bug report. and he/she wrote "It is not something you can fix without recreating initrd. The script that is used here comes from kiwi dracut module.". I also add the 7zip file for each ISO "....10.40", "...10.57", "...10.73" that contains some log files. "boot.log" : "sudo cp /var/log/boot.log" "boot.msg" : "cp /var/log/boot.msg" "dmesg.txt" : Output of "dmesg" right after the first boot "fdisk.txt" : 0utput of "fdisk -l" right after first boot "journal.txt" : Output of "sudo journalctl --no-pager --full -b" Thank you very much. -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1213371] New: Dolphin cannot display HEIC images
by bugzilla_noreply＠suse.com 19 Apr '24

19 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213371 Bug ID: 1213371 Summary: Dolphin cannot display HEIC images Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: f.alexander.wilms(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Dolphin does not show thumbnails for .heic files. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1216080] New: cockpit-ws: /etc/cockpit/disallowed-users is ignored
by bugzilla_noreply＠suse.com 19 Apr '24

19 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1216080 Bug ID: 1216080 Summary: cockpit-ws: /etc/cockpit/disallowed-users is ignored Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: Cockpit-bugs(a)suse.de Reporter: amajer(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This affects all cockpit versions, not just TW. The default configuration we show in /etc/cockpit/disallowed-users, # List of users which are not allowed to login to Cockpit root but this list is ignored and root can login. What is missing this in /etc/pam.d/cockpit auth required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed followed by rest of the file. So we should either not ship this file, or setup pam accordingly. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1218390] New: "fdectl tpm-present" fails with the combination fdectl v0.7.2 / pcr-oracle v0.5.4
by bugzilla_noreply＠suse.com 18 Apr '24

18 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218390 Bug ID: 1218390 Summary: "fdectl tpm-present" fails with the combination fdectl v0.7.2 / pcr-oracle v0.5.4 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: 64bit OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: per(a)familjenoberg.se QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- At initial installation of tumbleweed fdectl v0.7.2 and pcr-oracle v0.5.4 are installed. Using this combination the command "fdectl tpm-present" fails with " . . . . Excess argument(s) Usage: pcr-oracle [options] pcr-index [updates...] . . . . " when executing "pcr-oracle --algorithm sha256 --input /dev/shm/fde.LD7ot9/sealed_secret --output /dev/shm/fde.LD7ot9/recovered unseal-secret 0,2,4,7,9" The problem is solved if for example pcr-oracle is downgraded to v0.5.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1213073] New: clang13-devel from Backports not installable on SLES 15 SP5
by bugzilla_noreply＠suse.com 18 Apr '24

18 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213073 Bug ID: 1213073 Summary: clang13-devel from Backports not installable on SLES 15 SP5 Classification: openSUSE Product: openSUSE Backports Version: SLE-15-SP5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Packages Assignee: packagehub-bugs(a)suse.com Reporter: amoog(a)psi.de QA Contact: packagehub-bugs(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Trying to install clang13-devel from the Backports repository results in: :~ -> sudo zypper install clang13-devel Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides 'clang-tools >= 13.0.1' needed by the to be installed clang13-devel-13.0.1-bp155.6.38.x86_64 Solution 1: do not install clang13-devel-13.0.1-bp155.6.38.x86_64 Solution 2: break clang13-devel-13.0.1-bp155.6.38.x86_64 by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c/d/?] (c): ^C Is there some other repository I am missing? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1217749] New: No bass in built-in speakers on Lenovo Slim 7 16" AMD
by bugzilla_noreply＠suse.com 17 Apr '24

17 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1217749 Bug ID: 1217749 Summary: No bass in built-in speakers on Lenovo Slim 7 16" AMD Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: variable_valuables761(a)simplelogin.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 871116 --> https://bugzilla.suse.com/attachment.cgi?id=871116&action=edit Output of "hwinfo --sound" for Lenovo 16ARH7 It seems the bass speakers do not work in the latest Tumbleweed KDE snapshot on the Lenovo Slim 7 16" AMD, 16ARH7, 82UX0001US (and this same model is called Yoga outside the United States). This issue appears to be similar to that of the wide range of recently released laptops that have the CS35L41 and TAS2781 amps, however I cannot find that hardware listed in any of my logs or online spec sheets for this laptop. The closest I can find is that is has a Realtek ALC3287 codec. Attached is the output of "hwinfo --sound" Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1213159] New: [request] Lock root account by default
by bugzilla_noreply＠suse.com 17 Apr '24

17 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213159 Bug ID: 1213159 Summary: [request] Lock root account by default Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: milachew(a)mail.lv QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since MicroOS aims to keep administration as small as possible, it makes sense to consider blocking root account by default. Original comment: https://www.reddit.com/r/openSUSE/comments/14u7ka1/comment/jr60ogz/?utm_sou… P.S. By the way, there have already been similar discussions, but regarding ALP: https://bugzilla.opensuse.org/show_bug.cgi?id=1203978 -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1217244] New: mathgl fails to build ==> Fatal error occurred, no output PDF file produced!
by bugzilla_noreply＠suse.com 17 Apr '24

17 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1217244 Bug ID: 1217244 Summary: mathgl fails to build ==> Fatal error occurred, no output PDF file produced! Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello mathgl does not build on Leap 15.6. This should be fixed before Beta (Feb 2023). https://en.opensuse.org/openSUSE:Roadmap#Schedule_for_openSUSE_Leap_15.6 Build log from Leap 15.6 https://build.opensuse.org/package/live_build_log/openSUSE:Backports:SLE-15… [ 500s] /home/abuild/rpmbuild/BUILD/mathgl-8.0.1/python3_build/texinfo/samples.texi:142 [ 500s] 6: ==> Fatal error occurred, no output PDF file produced! [ 500s] Transcript written on mathgl_en.log. [ 500s] /usr/bin/texi2dvi: pdfetex exited with bad status, quitting. [ 500s] make[2]: *** [texinfo/CMakeFiles/doc_en.dir/build.make:243: texinfo/mathgl_en.pdf] Error 1 [ 500s] make[2]: Leaving directory '/home/abuild/rpmbuild/BUILD/mathgl-8.0.1/python3_build' [ 500s] make[1]: *** [CMakeFiles/Makefile2:1486: texinfo/CMakeFiles/doc_en.dir/all] Error 2 [ 500s] make: *** [Makefile:139: all] Error 2 [ 500s] error: Bad exit status from /var/tmp/rpm-tmp.nATkRq (%build) -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1217254] New: python-Django1 fails to build as test_delete_signals fails
by bugzilla_noreply＠suse.com 17 Apr '24

17 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1217254 Bug ID: 1217254 Summary: python-Django1 fails to build as test_delete_signals fails Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello python-Django1 does not build on Leap 15.6. This should be fixed before Beta (Feb 2023). https://en.opensuse.org/openSUSE:Roadmap#Schedule_for_openSUSE_Leap_15.6 Build log from Leap 15.6 https://build.opensuse.org/package/live_build_log/openSUSE:Backports:SLE-15… [ 154s] ====================================================================== [ 154s] FAIL: test_delete_signals (signals.tests.SignalTests) [ 154s] ---------------------------------------------------------------------- [ 154s] Traceback (most recent call last): [ 154s] File "/usr/lib64/python3.6/unittest/case.py", line 59, in testPartExecutor [ 154s] yield [ 154s] File "/usr/lib64/python3.6/unittest/case.py", line 608, in run [ 154s] self.tearDown() [ 154s] File "/home/abuild/rpmbuild/BUILD/Django-1.11.29/tests/signals/tests.py", line 33, in tearDown [ 154s] self.assertEqual(self.pre_signals, post_signals) [ 154s] File "/usr/lib64/python3.6/unittest/case.py", line 829, in assertEqual [ 154s] assertion_func(first, second, msg=msg) [ 154s] File "/usr/lib64/python3.6/unittest/case.py", line 1039, in assertTupleEqual [ 154s] self.assertSequenceEqual(tuple1, tuple2, msg, seq_type=tuple) [ 154s] File "/usr/lib64/python3.6/unittest/case.py", line 1010, in assertSequenceEqual [ 154s] self.fail(msg) [ 154s] File "/usr/lib64/python3.6/unittest/case.py", line 670, in fail [ 154s] raise self.failureException(msg) [ 154s] AssertionError: Tuples differ: (1, 0, 2, 1) != (1, 0, 2, 0) [ 154s] [ 154s] First differing element 3: [ 154s] 1 [ 154s] 0 [ 154s] [ 154s] - (1, 0, 2, 1) [ 154s] ? ^ [ 154s] [ 154s] + (1, 0, 2, 0) [ 154s] ? ^ [ 154s] -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1214027] New: All user may connect to this network should not be enable by default
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214027 Bug ID: 1214027 Summary: All user may connect to this network should not be enable by default Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: cosmin.tanczel(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Whenever a new connection is created using the network manager applet in KDE, the option "All user may connect to this network" should not be enabled by default. Reasoning: 1. Security - there are users that just input the root password so the created connection is available for everybody, even though this should not be the case. (I know, if the user has root access he should know what he's doing, but still) 2. Unnecessary step in the creation of a new connection process. Might be there is a reasoning to have it enabled by default, so please let me know if this is the case. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1214176] New: VUL-0: CVE-2023-39959: nextcloud: calendar or address book existence leak via DAV
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214176 Bug ID: 1214176 Summary: VUL-0: CVE-2023-39959: nextcloud: calendar or address book existence leak via DAV Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374996/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39959 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39959 https://www.cve.org/CVERecord?id=CVE-2023-39959 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g… https://github.com/nextcloud/server/pull/38747 https://hackerone.com/reports/1832126 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214175] New: VUL-0: CVE-2023-39958: nextcloud: missing bruteforce protection for client secrets of configured OAuth2 clients
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214175 Bug ID: 1214175 Summary: VUL-0: CVE-2023-39958: nextcloud: missing bruteforce protection for client secrets of configured OAuth2 clients Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374995/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39958 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39958 https://www.cve.org/CVERecord?id=CVE-2023-39958 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v… https://github.com/nextcloud/server/pull/38773 https://hackerone.com/reports/1258448 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214177] New: VUL-0: CVE-2023-39961: nextcloud: image download restriction bypass
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214177 Bug ID: 1214177 Summary: VUL-0: CVE-2023-39961: nextcloud: image download restriction bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374997/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39961 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39961 https://www.cve.org/CVERecord?id=CVE-2023-39961 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q… https://github.com/nextcloud/text/pull/4481 https://hackerone.com/reports/1965156 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214178] New: VUL-0: CVE-2023-39962: nextcloud: unrestricted external storage deletion
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214178 Bug ID: 1214178 Summary: VUL-0: CVE-2023-39962: nextcloud: unrestricted external storage deletion Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374998/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39962 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. As a workaround, disable app files_external. This also makes the external storage inaccessible but retains the configurations until a patched version has been deployed. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39962 https://www.cve.org/CVERecord?id=CVE-2023-39962 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… https://github.com/nextcloud/server/pull/39323 https://hackerone.com/reports/2047168 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214179] New: VUL-0: CVE-2023-39963: nextcloud: missing password check allows attackers to add app passwords on compromised accounts
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214179 Bug ID: 1214179 Summary: VUL-0: CVE-2023-39963: nextcloud: missing password check allows attackers to add app passwords on compromised accounts Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374999/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39963 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39963 https://www.cve.org/CVERecord?id=CVE-2023-39963 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j… https://github.com/nextcloud/server/pull/39416 https://hackerone.com/reports/2067572 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1214181] New: VUL-0: CVE-2023-39952: nextcloud: unrestricted subfolder access despite advanced permission checks
by bugzilla_noreply＠suse.com 16 Apr '24

16 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1214181 Bug ID: 1214181 Summary: VUL-0: CVE-2023-39952: nextcloud: unrestricted subfolder access despite advanced permission checks Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/374976/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-39952 Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions would block access to the subfolder. Nextcloud Server versions 25.0.8, 26.0.3, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1 contain a patch for this issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39952 https://bugzilla.redhat.com/show_bug.cgi?id=2231145 https://www.cve.org/CVERecord?id=CVE-2023-39952 https://github.com/nextcloud/groupfolders/issues/1906 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c… https://github.com/nextcloud/server/pull/38890 https://hackerone.com/reports/1808079 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1215343] New: Aeon does not support webp images.
by bugzilla_noreply＠suse.com 15 Apr '24

15 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1215343 Bug ID: 1215343 Summary: Aeon does not support webp images. Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Desktop Environment Assignee: rbrown(a)suse.com Reporter: gchm2(a)quicknet.nl QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Aeon dows not support webp images so those images cannot be set as a wallpaper in GNOME and nautilus cannot create thumbnails of those images. I think the package webp-pixbuf-loader should be part of the base system for a better out of the box experience. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1213496] New: Man pages and documentation in general missing
by bugzilla_noreply＠suse.com 15 Apr '24

15 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1213496 Bug ID: 1213496 Summary: Man pages and documentation in general missing Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Distrobox Assignee: rbrown(a)suse.com Reporter: kjong+lists(a)neobits.nl QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- In Aeon the system is immutable and shouldn't be touched. However, there are no man pages installed. This is not really user-friendly. But maybe it's on purpose to make sure people don't touch their base install? But even after doing `distrobox enter` and you download and enter the default distrobox, which is `registry.opensuse.org/opensuse/distrobox:latest`, I still don't get manual pages. This makes using the system harder than it should be. What's the reasoning to not include documentation? On production non-interactive containers I get why man pages are a waste of disk space. But distrobox is meant to be used as a normal user environment. In such an environment people expect to find man pages. Otherwise the system is in the way of getting things done. In contrast, Fedora Silverblue has the man pages installed in the base OS, but also in their default toolbox image. Which to me makes perfect sense. Humans are going to use those environment interactively. Googling/Ducking for man pages online would be weird and the `--help` output isn't always complete or fully helpful. Can man pages be included in Aeon and in the toolbox containers? -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1219098] New: Add package for EPSON printers
by bugzilla_noreply＠suse.com 15 Apr '24

15 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1219098 Bug ID: 1219098 Summary: Add package for EPSON printers Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Patterns Assignee: rbrown(a)suse.com Reporter: emtorres(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The system correctly autodetects an EPSON printer, but since it does not have the ESC/P-R driver, it adds it as if it were an HP printer. I think it's useful to have this package since it is a generic driver for EPSON printers and scanners. The package is epson-inkjet-printer-escpr. -- You are receiving this mail because: You are on the CC list for the bug.

1 3