October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224150] New: [Build 20240511] boot_encrypt: grub does not ask for encryption key
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1224150 Bug ID: 1224150 Summary: [Build 20240511] boot_encrypt: grub does not ask for encryption key Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/4179275/modules/boot _encrypt/steps/2 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation Grub no longer asks for the decryption key. The snapshot contained a grub2 change: +- Fix gcc error with CFLAGS=-Og + * grub2-grubenv-in-btrfs-header.patch + Which sounds harmless there were also plymouth changes, but the failure seems too early for plymouth openQA test in scenario opensuse-Tumbleweed-NET-x86_64-lvm-encrypt-separate-boot@64bit fails in [boot_encrypt](https://openqa.opensuse.org/tests/4179275/modules/boot_encryp… ## Test suite description Same as lvm-full-encrypt, but with separate boot not encrypted partition. Maintainer: riafarov INSTALLONLY=1 UNENCRYPTED_BOOT=1 DESKTOP=gnome ENCRYPT=1 FULL_LVM_ENCRYPT=1 ## Reproducible Fails since (at least) Build [20240509](https://openqa.opensuse.org/tests/4172240) ## Expected result Last good: [20240508](https://openqa.opensuse.org/tests/4169788) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1212947] New: Disable fbdev userspace interfaces and programs
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1212947 Bug ID: 1212947 Summary: Disable fbdev userspace interfaces and programs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: tzimmermann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- We want to remove fbdev from kernel and userspace as far as possible. Linux 6.6 will allow us to disable fbdev's userspace interfaces, most noteably /dev/fb*. Enable this feature in the TW kernel. Framebuffer support has been an endless source of bugs. Not giving userspace access to it's internals and framebuffer memory will close a possible entry point for all sorts of malware. Please note that the framebuffer console is implemented entirely within the kernel and will not be affected by this change. -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1226586] New: avahi-browse -a fails with "Invalid service type"
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226586 Bug ID: 1226586 Summary: avahi-browse -a fails with "Invalid service type" Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: martin.wilck(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The following error occurs on multiple openSUSE systems, both 15.6 and Factory: Error: > avahi-browse -v -a Server version: avahi 0.8; Host name: ares.local E Ifce Prot Name Type Domain + eth0 IPv4 connector-0 _spotify-connect._tcp local + eth0 IPv4 one-s-0 _spotify-connect._tcp local : Cache exhausted + eth0 IPv4 Raumfeld-One-S-5aa49215a71dce5d5e3942e76961a1d1 _googlecast._tcp local + eth0 IPv4 Raumfeld-Connector-d40ebb7d92cef2980bd98614fc032254 _googlecast._tcp local + eth0 IPv4 5aa49215-a71d-ce5d-5e39-42e76961a1d1 _googlezone._tcp local + eth0 IPv4 d40ebb7d-92ce-f298-0bd9-8614fc032254 _googlezone._tcp local + eth0 IPv4 192-168-1-4 Microsoft Windows Network local + eth0 IPv4 fritz-box Microsoft Windows Network local + eth0 IPv4 PROXY Microsoft Windows Network local + eth0 IPv4 ANANAS Microsoft Windows Network local + eth0 IPv4 one-s SFTP File Transfer local + eth0 IPv4 connector SFTP File Transfer local + eth0 IPv4 2064991846AFDD81 _matterd._udp local + eth0 IPv4 dahua1 Web Site local + eth0 IPv4 PROXY Device Info local + eth0 IPv4 ANANAS Device Info local avahi_service_browser_new() failed: Invalid service type > avahi-browse -v -a Server version: avahi 0.8; Host name: ares.local E Ifce Prot Name Type Domain avahi_service_browser_new() failed: Invalid service type # Preliminary analysis via dbus monitor The client makes an invalid ServiceBrowserNew() method call with empty service type parameter: ‣ Type=method_call Endian=l Flags=0 Version=1 Cookie=31 Timestamp="Thu 2024-06-20 10:05:32.977645 UTC" Sender=:1.657 Destination=org.freedesktop.Avahi Path=/ Interface=org.freedesktop.Avahi.Server Member=ServiceBrowserNew UniqueName=:1.657 MESSAGE "iissu" { INT32 -1; INT32 -1; STRING ""; STRING ""; UINT32 0; }; ‣ Type=error Endian=l Flags=1 Version=1 Cookie=137 ReplyCookie=31 Timestamp="Thu 2024-06-20 10:05:32.977975 UTC" Sender=:1.656 Destination=:1.657 ErrorName=org.freedesktop.Avahi.InvalidServiceTypeError ErrorMessage="Invalid service type" UniqueName=:1.656 MESSAGE "s" { STRING "Invalid service type"; }; It appears that this service type has been previously passed from the daemon to the client via a DBus signal, either one of the following: Type=signal Endian=l Flags=1 Version=1 Cookie=133 Timestamp="Thu 2024-06-20 10:05:32.976296 UTC" Sender=:1.656 Destination=:1.657 Path=/Client1/ServiceTypeBrowser1 Interface=org.freedesktop.Avahi.ServiceTypeBrowser Member=ItemNew UniqueName=:1.656 MESSAGE "iissu" { INT32 2; INT32 0; STRING ""; STRING ""; UINT32 4; }; ‣ Type=signal Endian=l Flags=1 Version=1 Cookie=134 Timestamp="Thu 2024-06-20 10:05:32.976485 UTC" Sender=:1.656 Destination=:1.657 Path=/Client1/ServiceTypeBrowser1 Interface=org.freedesktop.Avahi.ServiceTypeBrowser Member=ItemNew UniqueName=:1.656 MESSAGE "iissu" { INT32 2; INT32 0; STRING ""; STRING "local"; UINT32 4; }; -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1229450] New: libbpf: failed to find '.BTF' ELF section in vmlinux
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229450 Bug ID: 1229450 Summary: libbpf: failed to find '.BTF' ELF section in vmlinux Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876820 --> https://bugzilla.suse.com/attachment.cgi?id=876820&action=edit Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586 build log The kernel builds result in random build failures while creating BTF. For example https://build.opensuse.org/package/live_build_log/Kernel:vanilla/kernel-sou…: > libbpf: failed to find '.BTF' ELF section in vmlinux > FAILED: load BTF from vmlinux: No data available > make[2]: *** [../scripts/Makefile.vmlinux:34: vmlinux] Error 255 > make[2]: *** Deleting file 'vmlinux' > make[1]: *** [/home/abuild/rpmbuild/BUILD/kernel-vanilla-6.11~rc3.338.gc3f2d783a459/linux-6.11-rc3-338-gc3f2d783a459/Makefile:1158: vmlinux] Error 2 > make: *** [../Makefile:224: __sub-make] Error 2 > error: Bad exit status from /var/tmp/rpm-tmp.olf5Nu (%build) arm seems to fail reliably. But for example in ibs://Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586, it looks like it is sort of random. kernel-debug and kernel-vanilla fails for i586, but -default and -pae are built currently. See the job history for kernel-vanilla in there (the failed boot log is attached): > time package reason code build time worker > 2024-07-15 07:41:48 kernel-source:kernel-vanilla source change succeeded 47m 53s h01-ch5a:3 > 2024-07-15 23:56:48 kernel-source:kernel-vanilla source change succeeded 47m 57s h01-ch5b:5 > 2024-07-18 11:12:40 kernel-source:kernel-vanilla source change succeeded 48m 46s h01-ch5b:2 > 2024-07-26 20:01:29 kernel-source:kernel-vanilla source change succeeded 52m 40s h01-ch4b:2 > 2024-07-29 09:07:35 kernel-source:kernel-vanilla source change succeeded 52m 53s h01-ch4a:6 > 2024-08-03 11:38:55 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch4b:8 > 2024-08-04 23:48:15 kernel-source:kernel-vanilla source change failed 25m 14s h01-ch4b:7 > 2024-08-06 16:37:35 kernel-source:kernel-vanilla source change succeeded 53m 25s h01-ch4b:4 > 2024-08-09 19:44:44 kernel-source:kernel-vanilla source change failed 26m 4s h01-ch5a:2 > 2024-08-11 22:48:56 kernel-source:kernel-vanilla source change failed 0m 38s h01-ch4b:6 > 2024-08-12 16:44:52 kernel-source:kernel-vanilla source change succeeded 54m 0s h01-ch5b:5 > 2024-08-15 21:49:11 kernel-source:kernel-vanilla source change failed 25m 25s h01-ch4b:1 > 2024-08-19 01:53:01 kernel-source:kernel-vanilla source change succeeded 50m 9s h01-ch4a:5 > 2024-08-19 11:33:50 kernel-source:kernel-vanilla source change succeeded 55m 9s h01-ch5b:1 > 2024-08-19 17:23:59 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch5a:3 -- You are receiving this mail because: You are on the CC list for the bug.

1 35

[Bug 1229913] New: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229913 Bug ID: 1229913 Summary: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: popov895(a)ukr.net Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1205607 We've been asked to have a fresh look ad kio-admin, formerly rejected in bug 1205607. AFAIK upstream activities to come up with a robust API have been abandoned, but we can still have another look at the current production code. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1232527] New: [SELinux] "systemd-bless-boot good" fail during boot time
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232527 Bug ID: 1232527 Summary: [SELinux] "systemd-bless-boot good" fail during boot time Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: danilo.spinella(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: openSUSE MicroOS SELinux status, mode and policy name: enabled, enforcing, targeted SELinux policy version and repository: 20241021-1.1, openSUSE-Tumbleweed-Oss The software (incl. version) that is affected by the SELinux issue and the error message: systemd 256.7, systemd-bless-boot, "Failed to rename '/loader/entries/opensuse-microos-6.11.5-1-default-1+2-1.conf' to '/loader/entries/opensuse-microos-6.11.5-1-default-1.conf': Permission Denied" SELinux Audit log: type=AVC msg=audit(1730195064.486:34): avc: denied { rename } for pid=1142 comm="systemd-bless-b" name="opensuse-microos-6.11.5-1-default-1+2-1.conf" dev="vda2" ino=11 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=0 Any other important details: N/A -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1229813] New: dbus.socket does not start dbus-broker.service
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229813 Bug ID: 1229813 Summary: dbus.socket does not start dbus-broker.service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Services which require dbus have a dependency on dbus.socket in their service file. dbus-broker has no dbus.service file, thus this dependencies are broken and a boot only succeeds by pure luck. -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1226207] New: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226207 Bug ID: 1226207 Summary: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- kf6-breeze-icons generate identical icons for both breeze & breeze-dark. While this is not an issue for KF6 apps, that use run-time recoloring, in KF5 apps, like Krusader, when dark color theme is used and icons are breeze-dark symbolic icons are dark on dark background and almost invisible. The reason is this build option: `-DWITH_ICON_GENERATION:BOOL=FALSE` I've tried to make my custom build [1] switching it to TRUE and breeze-dark icons are fine with Krusader now. But I don't know the reasoning behind switching it to FALSE. There is comment: ``` saves ~30MB and installs dangling symlinks ``` Less size is true, though IMHO it's not a good solution to break KF5 apps to save some space. But I can't see any dangling symlinks: ``` find /usr/share/icons/breeze{,-dark} -xtype l ``` doesn't find anything. Any other reason or should I cleanup [1] and make a submit request? [1] https://build.opensuse.org/package/show/home:NickLion:branches:KDE:Framewor… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1221568] New: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1221568 Bug ID: 1221568 Summary: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393624/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22513 https://www.zerodayinitiative.com/advisories/ZDI-24-101/ https://www.cve.org/CVERecord?id=CVE-2024-22513 https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 https://bugzilla.redhat.com/show_bug.cgi?id=2269822 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 5