October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1231443] New: VUL-0: CVE-2024-46292: modsecurity: excessive resource consumption when processing POST requests with extremely large content-lengths
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231443 Bug ID: 1231443 Summary: VUL-0: CVE-2024-46292: modsecurity: excessive resource consumption when processing POST requests with extremely large content-lengths Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/423485/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: dimstar(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-46292 https://www.cve.org/CVERecord?id=CVE-2024-46292 https://github.com/owasp-modsecurity/ModSecurity/blob/v3/master/README.md https://github.com/yoloflz101/yoloflz/blob/main/README.md -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1231174] New: std::chrono::zoned_time runtime error
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231174 Bug ID: 1231174 Summary: std::chrono::zoned_time runtime error Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: Gerhard(a)Dr-Lorbeer.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 877674 --> https://bugzilla.suse.com/attachment.cgi?id=877674&action=edit Example Project summary: No timezone computation possible Latest tumbleweed. kdevelop, c++ Example: https://en.cppreference.com/w/cpp/chrono/zoned_time compile OK. run: Error: std::chrono::tzdb: cannot locate zone: Africa/Casablanca Error: std::chrono::tzdb: cannot locate zone: America/Argentina/Buenos_Aires Error: std::chrono::tzdb: cannot locate zone: America/Barbados Error: std::chrono::tzdb: cannot locate zone: America/Indiana/Petersburg Error: std::chrono::tzdb: cannot locate zone: America/Tarasco_Bar Error: std::chrono::tzdb: cannot locate zone: Antarctica/Casey Error: std::chrono::tzdb: cannot locate zone: Antarctica/Vostok Error: std::chrono::tzdb: cannot locate zone: Asia/Magadan Error: std::chrono::tzdb: cannot locate zone: Asia/Manila Error: std::chrono::tzdb: cannot locate zone: Asia/Shanghai Error: std::chrono::tzdb: cannot locate zone: Asia/Tokyo Error: std::chrono::tzdb: cannot locate zone: Atlantic/Bermuda Error: std::chrono::tzdb: cannot locate zone: Australia/Darwin Error: std::chrono::tzdb: cannot locate zone: Europe/Isle_of_Man Error: std::chrono::tzdb: cannot locate zone: Europe/Laputa Error: std::chrono::tzdb: cannot locate zone: Indian/Christmas Error: std::chrono::tzdb: cannot locate zone: Indian/Cocos Error: std::chrono::tzdb: cannot locate zone: Pacific/Galapagos -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1218424] go1.22 release tracking
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1218424 https://bugzilla.suse.com/show_bug.cgi?id=1218424#c41 --- Comment #41 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:3571-1: An update that has one fix can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20243571-1 Category: recommended (moderate) Bug References: 1218424 Maintenance Incident: [SUSE:Maintenance:35914](https://smelt.suse.de/incident/35914/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): go1.22-1.22.8-1.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229122] go1.23 release tracking
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1229122 https://bugzilla.suse.com/show_bug.cgi?id=1229122#c24 --- Comment #24 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:3572-1: An update that has one fix can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20243572-1 Category: recommended (moderate) Bug References: 1229122 Maintenance Incident: [SUSE:Maintenance:35915](https://smelt.suse.de/incident/35915/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): go1.23-1.23.2-1.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218424] go1.22 release tracking
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1218424 https://bugzilla.suse.com/show_bug.cgi?id=1218424#c40 --- Comment #40 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:3573-1: An update that has one fix can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20243573-1 Category: recommended (moderate) Bug References: 1218424 Maintenance Incident: [SUSE:Maintenance:35916](https://smelt.suse.de/incident/35916/) Sources used: openSUSE Leap 15.6 (src): go1.22-1.22.8-150000.1.30.1 Development Tools Module 15-SP5 (src): go1.22-1.22.8-150000.1.30.1 Development Tools Module 15-SP6 (src): go1.22-1.22.8-150000.1.30.1 openSUSE Leap 15.5 (src): go1.22-1.22.8-150000.1.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229122] go1.23 release tracking
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1229122 https://bugzilla.suse.com/show_bug.cgi?id=1229122#c23 --- Comment #23 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:3574-1: An update that has one fix can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20243574-1 Category: recommended (moderate) Bug References: 1229122 Maintenance Incident: [SUSE:Maintenance:35917](https://smelt.suse.de/incident/35917/) Sources used: openSUSE Leap 15.5 (src): go1.23-1.23.2-150000.1.9.1 openSUSE Leap 15.6 (src): go1.23-1.23.2-150000.1.9.1 Development Tools Module 15-SP5 (src): go1.23-1.23.2-150000.1.9.1 Development Tools Module 15-SP6 (src): go1.23-1.23.2-150000.1.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1230132] Intermittent sound Lenovo Legion Pro 7 16IRX8H (Intel CPU)
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1230132 https://bugzilla.suse.com/show_bug.cgi?id=1230132#c28 --- Comment #28 from Takashi Iwai <tiwai(a)suse.com> --- Scratch that, it turned out that my fix doesn't work as expected. So we went back to square. Given that it's possibly a runtime PM issue, what happens if you do the system suspend/resume once after the problem happens? Does it cure, or the problem remains afterwards? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227144] iwlwifi 0000:6f:00.0: Microcode SW error detected. Restarting 0x0.
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227144 https://bugzilla.suse.com/show_bug.cgi?id=1227144#c13 --- Comment #13 from Andreas <opendreas(a)gmail.com> --- I installed Leap 16 preAlpha in Virtualbox, the warnings remained, but there were no wifi errors as is the case with Windows. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231323] core dump (Segmentation fault) when ending repository management
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231323 https://bugzilla.suse.com/show_bug.cgi?id=1231323#c14 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(zypp-maintainers@ | |suse.de) --- Comment #14 from Stefan Hundhammer <shundhammer(a)suse.com> --- Zypp maintainers, and idea what might be wrong here? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231323] core dump (Segmentation fault) when ending repository management
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231323 https://bugzilla.suse.com/show_bug.cgi?id=1231323#c13 --- Comment #13 from Stefan Hundhammer <shundhammer(a)suse.com> --- I tried many things, but so far, all of them were inconclusive. I can reliably reproduce this on Leap 15.6 (with the YaST:Head repo), on Slowroll (without the YaST:Head repo) and on the latest TW, both with and without the YaST:Head repo: Adding any of the community repos and then using the "OK" button to exit the YaST repo module crashes it every time. I also tried wit Y2DEBUG=1 for some more detailed logging: > 16:33:35 <0> [ui] YUI.cc(terminateUIThread):256 Sending shutdown message to UI thread > 16:33:35 <1> [qt-ui] YQUI.cc(uiThreadDestructor):320 Destroying UI thread > 16:33:35 <0> [ui] YUI.cc(uiThreadMainLoop):380 Shutting down UI main loop > 16:33:35 <0> [ui] YUI.cc(terminateUIThread):263 UI thread shut down correctly > 16:33:35 <1> [qt-ui] YQUI.cc(~YQUI):302 Closing down Qt UI. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/sysconfig/console did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/sysconfig/language did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/os-release did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /usr/share/applications/YaST2/org.opensuse.yast.SWSource.desktop did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /usr/share/applications/YaST2/org.opensuse.yast.SWSource.desktop did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /usr/share/applications/YaST2/org.opensuse.yast.SWSource.desktop did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/YaST2/ProductFeatures did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/os-release did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/os-release did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/os-release did not change. Not saving. > 16:33:35 <0> [agent-ini] IniParser.cc(write):942 File /etc/sysconfig/proxy did not change. Not saving. > 16:33:35 <0> [agent-system] SystemAgent.cc(remove_directory):99 Removing temporary file /tmp/YaST2-10809-P7puFA/exit > 16:33:35 <0> [agent-system] SystemAgent.cc(remove_directory):99 Removing temporary file /tmp/YaST2-10809-P7puFA/inst_productsources_downloadfile > 16:33:35 <0> [agent-system] SystemAgent.cc(remove_directory):99 Removing temporary file /tmp/YaST2-10809-P7puFA/product-license/6 > 16:33:35 <0> [agent-system] SystemAgent.cc(remove_directory):99 Removing temporary file /tmp/YaST2-10809-P7puFA/product-license > 16:33:35 <0> [agent-system] SystemAgent.cc(remove_directory):99 Removing temporary file /tmp/YaST2-10809-P7puFA/stderr > 16:33:35 <0> [agent-system] SystemAgent.cc(remove_directory):99 Removing temporary file /tmp/YaST2-10809-P7puFA/stdout > 16:33:35 <0> [agent-system] SystemAgent.cc(remove_directory):99 Removing temporary file /tmp/YaST2-10809-P7puFA > 16:33:35 <0> [Pkg] Y2CCPkg.cc(~Y2CCPkg):64 ~Y2CCPkg > 16:33:35 <0> [Pkg] PkgModule.cc(destroy):101 Deleting PkgModule object... > 16:33:35 <0> [Pkg] Callbacks.cc(~CallbackHandler):1925 Deleting callback handler > 16:33:35 <1> [Pkg] PkgFunctions.cc(~PkgFunctions):152 Releasing the repo manager... > 16:33:35 <1> [Pkg] PkgFunctions.cc(~PkgFunctions):159 Releasing the zypp pointer... > 16:33:35 <1> [Pkg] PkgFunctions.cc(~PkgFunctions):161 Zypp pointer released Again, the final message is missing, indicating that it crashed at this point. -- You are receiving this mail because: You are on the CC list for the bug.

1 0